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SECOND REPORT FROM 





The Science and Technology Committee is appointed under Standing Order No 152 to examine the 
expenditure, administration and policy of the Office of Science and Technology and associated public 


bodies. 


The Committee consists of 11 Members. It has a quorum of three. Unless the House otherwise 
orders, all Members nominated to the Committee continue to be Members of it for the remainder of the 
Parliament. 


The Committee has power: 


(a) 
(b) 


(c) 


(d) 


to send for persons, papers and records, to sit notwithstanding any adjournment of the House, 
to adjourn from place to place, and to report from time to time; 


to appoint specialist advisers either to supply information which is not readily available or to 
elucidate matters of complexity within the Committee's order of reference; 


to communicate to any other such committee and to the Committee of Public Accounts, to the 
Deregulation Committee and to the Environmental Audit Committee its evidence and any other 
documents relating to matters of common interest; and 


to meet concurrently with any other such committee for the purposes of deliberating, taking 
evidence, or considering draft reports. 


The following were nominated Members of the Committee on 14 July 1997: 


Mr David Atkinson Mr Nigel Jones 

Mr Nigel Beard Dr Ashok Kumar 

Dr Michael Clark Mrs Caroline Spelman 
Mrs Claire Curtis-Thomas Dr Desmond Turner 
Dr Ian Gibson Dr Alan W Williams 


Dr Lynne Jones 


Dr Michael Clark was elected Chairman on 30 July 1997. 





The cost of printing and publishing this Volume is estimated by The Stationery Office at £11,355 
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MINUTES OF EVIDENCE 


WEDNESDAY 19 NOVEMBER 1997 


Members Present: 


Dr Michael Clark, in the Chair 


Mr David Atkinson Mr Nigel Jones 

Mr Nigel Beard Mrs Caroline Spelman 
Dr Ian Gibson Dr Desmond Turner 
Dr Lynne Jones Dr Alan W Williams 


Memorandum submitted by Taskforce 2000 


INTRODUCTION 


Taskforce 2000 is a not-for-profit company, limited by guarantee, formed in August 1996 on the initiative 
of the Minister for Science and Technology at the DTI. Its main objective has been to raise private sector 
awareness of the computer date-change issue. Most of its funding has come from Government. 


SUMMARY OF EVIDENCE 


The problem is far more serious than most people realise. 

The consequences of failure could be dire. 

Thousands of organisations risk not being ready on time. 

Although awareness seems high, understanding is poor. 

The main obstacle is that senior people are not giving it adequate priority. 
Government should do more to communicate the need for urgent action. 


1. THE SERIOUSNESS OF THE PROBLEM 


1.1 The problem is considerably more serious and urgent than most people realise. If we get it wrong, 
businesses could fail and basic services (financial, utilities, telecomms, health care, etc.) might not be 
delivered—the economic and social consequences would be appalling. At present, the UK is getting it wrong. 


1.2 Eight characteristics of the problem put this into focus: 
1. most computer systems (large and small, old and new) and almost countless “embedded” 
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microprocessor chips are potentially affected; 


. systems that are not fixed in time will fail; 

. failure is likely to have severe business, economic, social and political consequences; 

. there is insufficient specialist resource for a comprehensive solution; 

. there is insufficient time for a comprehensive solution; 

. the deadline cannot be extended; 

. the computer industry has a dreadful record of missing deadlines—about 80 per cent are late; and 


. senior people in Government and business and leaders of the computer industry are not giving the 


matter adequate priority. 


2. ARE UK ORGANISATIONS SUFFICIENTLY PREPARED? 


2.1 The simple answer is No. Although levels of awareness, in the superficial sense of knowing that there 
is a problem, are high, there is abundant evidence that this is not being turned into understanding and, 


therefore, action. 
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2.2 The best practice is to have the bulk of the job done by the end of 1998. There are good technical and 
business reasons for this. It is probable that any medium or large business that has not made an adequate 
start by 31 March 1998 will not make it—an “adequate start” means Board sponsorship, completion of a full 
systems audit, identification of all “mission critical” items (including third party interdependencies), a full 
budget and project team in place and conversion in hand. About 40,000 such businesses, employing around 
6,000,000 people, risk not making such a start in time. (Smaller businesses may have rather longer.) Evidence 
for this comes, inter alia, from the following recent surveys. 


2.3 A DTI/Sage/Taskforce 2000 survey indicates that less than 10 per cent of SMEs (small and medium 
sized enterprises) have completed a full audit and 57 per cent plan no budget until 1999—yet half of those 
getting on with it say they expect the job to take 12-18 months. 80 per cent plan to resolve the matter “in 
house”—although 50 per cent have no people to allocate to it. 


2.4 A Cap Gemini (Europe’s largest computer services company) survey indicates that: “One in ten 
organisations will fail to meet the deadline ... [and therefore] ... 29 per cent of GDP will be at risk.” If the 
timetable slips by three months, this becomes 37 per cent. On resources, they say demand will exceed supply 
by April 1998. The average time to resolve the problem is two years for medium-sized and two and a half for 
large businesses. 


2.5 Therefore, failing significant change in understanding within the next few weeks, we could be facing 
unprecedented difficulties. 


3. TASKFORCE 2000’s ROLE 


3.1 Its first objective was “to operate at a high level to support an initial goal of achieving 100 per cent 
awareness and commitment by March 1997.” Basic awareness was achieved on time. However, 
understanding and, therefore, commitment have proved more difficult. 


3.2 Funds are limited: only £300,000 of public money since July 1996, together with a DTI official on 
secondment since January (focusing on SMEs). Therefore, activities have been strictly focused: speaking at 
relevant conferences (three or four presentations per week—often more), getting close to the media (success 
with TV, radio, the technical and specialist press and the broadsheets) and meeting senior business managers, 
boards of directors and relevant professionals. More extensive PR activity has not been possible. 


4. POSSIBLE FAILURES OF SAFETY CRITICAL SYSTEMS 


4.1 The extent depends entirely on how soon people get on with fixing the problem. 


4.2 Some organisations are making contingency plans. Indeed, that—and damage limitation—are 
recognised by active organisations (including the oil and gas and nuclear industries) as an essential part of 
their date-change programme. 


5. IMPACT OF ACTION 2000 LAUNCH ON TASKFORCE 2000 WorK 


5.1 This is difficult to judge at the time of writing. On the face of it, Action 2000 should be able to provide 
a valuable service—there is a need for central advice and assistance of the kind being planned. 


5.2 However, the campaign is at a critical stage: if medium and larger businesses do not get started within 
the next few weeks, we face severe problems. Therefore, there must be no mixed messages and no confusion. 
And it is essential that the momentum created and maintained by Taskforce 2000 is not prejudiced. There are 
some indications that this might be happening. 


5.3 Taskforce 2000 understands the issues, has a successful track record, influences the agenda and knows 
the key journalists. Also its name is established as a clear and positive brand in the UK and internationally. 
It would be unwise to jeopardise these advantages 


6. Wuy 1s MorE NoT BEING DONE? 


6.1 There is a vicious circle:’senior people do not have it on their agenda because other senior people do 
not have it on theirs. In particular, the matter would get far more attention if it were seen as a key Government 
priority at Cabinet level. 
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6.2 The reasons that senior people do not take it seriously are understandable—but wrong. They include: 
— itis still described as “hype”; 
— itis seen as a technical matter; 
— in-house computer staff are misleading them; 
— other current global scare stories seem to be exaggerated; and 
— could the computer industry be so stupid? 


7. GOVERNMENT ACTION—COULD IT DO MORE? 
7.1 Internationally, Taskforce 2000 was a unique initiative—until very recently, no similar body existed 
elsewhere. 


7.2 Asaresult, awareness levels are probably higher in the UK than in any other country—and there may 
be more action here also. 


7.3 The main weakness is that the vehicle for getting things done, Taskforce 2000, has been poorly 
supported by past and present Governments. Compared with the problem, its funding has been pitiful. A 
result, for example, is that proposals for a short-term highly-focused advertising campaign (on the lines of 
the AIDS and self-assessment campaigns) have been impossible to implement. 


8. OTHER CONSIDERATIONS: 


— The matter raises important legal, audit and insurance issues. 

— Not least of these is senior people’s liability for failure. 

— There is inadequate action on the skills shortage. 

— Some systems being sold today are not compliant. 

— The embedded chip problem is underestimated—t is huge. 

— Interconnections (with third parties) are a critical factor. 

— Testing is a complex and massive part of the job. 

— The date-change problem will have a major impact on euro introduction. 
— The international dimension is critical and requires greater attention. 

— Contingency planning is essential—at national as well as corporate level. 


The key to the solution is radical prioritisation. 


12 November 1997 
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Examination of Witnesses 


Mr Rosin GUENIER, Executive Director, MR Ros Wirszycz, Chairman, and Mr IAN Huao, Executive 


Member, Taskforce 2000, were examined. 


Chairman 


1. Mr Guenier, good afternoon. Thank you for 
coming before the Select Committee this afternoon. 
I wonder if you would care to introduce the 
colleagues you have brought with you? 

(Mr Guenier) Yes, Chairman. On my left is Mr 
Rob Wirszycz, who is the Chairman of Taskforce 
2000. He is also the Director General of the CSSA, 
that is, the Computing Services and Software 
Association. On my right is Mr Ian Hugo. Ian is a 
member of the Taskforce Executive. He is the editor 
and largely the author of “Millennium Watch”, 
which is our regular newspaper, and he is also the 
part author of the BSI’s compliance definition and 
also the author of their code of practice and so I think 
well suited to this. 


2. Thank you very much indeed. Rather than invite 
you to give us an opening statement, perhaps I can 
ask you a question that enables you to use the answer 
aS an Opening statement. You said to us in your 
submission that “the problem is considerably more 
serious and urgent than most people realise”. How 
serious do you think this problem of computer 
compliance in the year 2000 really is? 

(Mr Guenier) I think it is very serious, as you have 
seen from my submission. My view is that if we fail 
to resolve this matter, the consequences will be more 
than the obvious business and economic 
consequences. I see the potential for social and 
political consequences and I fear that as this is only 
now two years away it is indeed a very urgent matter. 
Would you like me to develop that? 


3. Yes. That does not really quantify the 
seriousness of the problem. It just says the 
seriousness of the timescale. 

(Mr Guenier) I will give you some figures in a 
moment. Computers nowadays really control our 
lives. We have computers and computing systems, 
and by “computing systems” I include the 
microprocessing chips which exist in devices 
throughout our lives today, and these devices 
nowadays, together with computers, are really 
ordering the lives of most of us every day and this has 
become increasingly the case in the latter part of this 
century. Most of these systems have the potential for 
upset. Therefore, every business, every institution, 
every government department, has to tackle the 
problem and tackle it quickly because this is a big job. 
Our evidence in the private sector, putting it very 
broadly, is that about 40,000 medium or large 
businesses are at present not doing enough about it. 
Those companies employ approximately 6 million 
people and our view is if those businesses, those 
40,000—and there are many more, by the way, which 
have the problem—do not begin to address that 
problem in a serious way by the end of the current 
financial year, then I think those companies are in 
danger of not surviving this daté change. We are only 
now, therefore, approximately four months away 
from that. Therefore, I think it is extremely 


important that action be taken to turn those 
companies around and get them to face up to what 
needs to be done and make sure they do it. 


4. Some of those companies might say the whole 
seriousness of this issue has been “hyped” up. How 
do you respond to those who say that it has been 
“hyped” up and it is nowhere near as serious as you 
and your Taskforce make out? 

(Mr Guenier) Very few people within those 
companies who understand the issue in fact do say 
that. The allegation that this has been “hyped” up 
certainly exists in the newspapers. I would say this, 
that the purpose of “hype”, I suggest, would be in 
some way to create business for the computing 
industry. I can think of no other reason why anybody 
would “hype” it up unless they were just mischievous. 
The computing industry is in no way “hyping” this. 
It would be very hard for anyone to find the major 
companies in the computing industry pushing this 
matter forward as a major item. The reason for that 
essentially is this, that they are themselves very 
frightened of this issue. It is a very short-term issue. 
Anybody who gets involved in this has no-where to 
go when it is complete. There will be no future in it 
for them. The fact is that because of the shortage of 
resources in the IT industry it will take away effort 
from jobs they would much rather be doing, jobs 
with a bigger margin and jobs with a good deal more 
future. So they have no interest at all in “hyping” it, 
for that reason. The second reason is that they are 
very concerned indeed about the legal implications. 
There is hardly a firm of solicitors in the City of 
London who has not got a partner dealing with this 
almost exclusively, and I think the legal 
consequences for the IT industry are very serious 
indeed. So it would be a very strange thing for the 
computer industry to be “hyping” something which 
(a) is going to damage their business, (b) gives them 
this considerable threat from the law, and (c), if 
things go wrong the computing industry is going to 
look extremely foolish. This is a very odd and rather 
bizarre problem which we have. It seems 
extraordinary that this industry, which carried all 
before it at the end of the twentieth century, should 
have at its heart what is really an absurd and bizarre 
problem. I think if things go wrong people at large 
and in business will look at the computer industry 
with a new eye and will be very much more cynical 
and very much more careful about their dealings with 
them. So for these three reasons there is no reason 
whatever for the computer industry to “hype” it and 
I submit, Chairman, there is no “hype” involved in 
this at all and that, indeed, it has been understated in 
many cases, particularly by those likely to be the 
most damaged by it. 


5. Accepting the present rate of progress to tackle 
this problem, how likely is it that there will be a real 
danger to insurance and banking in the year 2000? 
Things are happening and things are moving forward 
and there will be a lot more progress even on the 
present graph. How realistic is the danger for the year 
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2000 for banking and insurance but, more 
importantly, for hospitals, air traffic control, 
emergency services, pensions and so on? 

(Mr Guenier) I think the two are interesting to 
compare. The City of London, the financial 
community, by and large have seen this problem 
coming for some time. They have set themselves up 
to deal with it. They have very substantial budgets. 
For example, the four main clearing banks, broadly 
speaking, have a combined budget of about £400 
million and one’s knowledge of computing is that 
that will probably go up. So we may be looking at 
half a billion just for the four clearing banks. 
Generally speaking, therefore, we are looking at very 
large budgets and a lot of activity in the City of 
London and in the financial community generally. 
That does not mean that they are exempt from 
problems or that there is no risk. I think there is some 
risk in the banking community and I am somewhat 
fearful of that, but it is a very much lesser risk than 
the risk we see elsewhere in the economy. You 
mentioned in particular the national health service 
and air traffic control systems. Air Traffic Control 
again have recognised this for some time and they are 
reasonably confident, not certain but reasonably 
confident, that their systems will be ready, at least in 
this country and in Western Europe and in North 
America. That does not mean they will be elsewhere 
in the world, of course. One thing I am very 
concerned about—and I will come back to my point 
about resources—is that there is inadequate resource 
to deal with this. Therefore, if these people, such as 
the City of London, such as Air Traffic Control, in 
fact absorb all the available resource, or a very high 
percentage of it, particularly from _ specialist 
consultants who are needed to help, I fear very much 
who is going to help the national health service. The 
point we have made in our submission is the need for 
prioritisation. It does seem to me there is a great 
danger that those who can afford it and those who 
saw it coming a long time ago are quite sensibly 
getting on with it and trying to do everything, and the 
very fact that they are doing that could damage parts 
of the economy, particularly in the public sector. 

Chairman: Thank you very much indeed. I think 
we shall come back to skill shortage in a few 
moments. May I now ask Mr Atkinson if he will lead 
us on to awareness and readiness for this date. 


Mr Atkinson 


6. Thank you, Mr Chairman. I have three separate 
questions. First of all, because most of us are laymen 
around this table, can you tell us very briefly, in 
understandable terms, precisely what would happen 
to British business if very little action were to be 

taken, and what is the action needed to be taken to 
avoid some of the problems which are being 
predicted if action is not taken? 

(Mr Guenier) Could I invite my colleague Ian 
Hugo to deal with that. 

(Mr Hugo) What will happen if no action is taken 
is that 80 per cent of computer systems of all kinds 
will fail. That is the general percentage of 
programmes that are affected that the large 
organisations who are into this problem have found, 
and something between 10 and 30 per cent of 
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embedded systems will fail in one way or another. So 
that is what will happen if no action is taken. You 
asked earlier about deadlines. 


7. The action needed to be taken? 

(Mr Hugo) The action that needs to be taken, there 
is a process that is quite well-known, which is to 
establish an inventory of systems that may be 
affected, to carry out an impact analysis of those 
systems to see if and where they are affected, and then 
to decide on some process for either fixing the system 
as it stands or replacing it or, indeed, scrapping it if 
it is not essential to the business. When all these fixes 
have been made, as I say to 80 per cent of the systems 
typically within the company, all the modified 
programmes then have to be tested where they react 
together as an assembly. They then have to be put 
back into production in the company and tested 
again in the production environment. So there is a 
fairly long process and the key, I think, is that never 
before have any companies attempted to disassemble 
all their systems, correct them, and re-assemble them 
in such a short space of time. 


8. When Taskforce 2000 was appointed last year, 
Mr Guenier, I think you said you would not be 
content unless there were 100 per cent awareness 
achieved within a year or so of the establishment, and 
as a year has now gone by, can you give us a measure 
as to whether you have achieved both 100 per cent 
awareness by British business of the problem and 
also a measure of the action that has been taken, the 
progress that has been made? 

(Mr Guenier) I will give you a brief answer and 
then ask Rob Wirszycz to comment as well. Our 
original target was to achieve 100 per cent awareness 
at board level by March of this year. The problem, of 
course, is, what does awareness mean, and I think 
that problem has got in the way of some 
understanding of this issue anyway. But superficially 
I think we have, broadly speaking, achieved that. I 
think levels of awareness in the United Kingdom, 
according to most of the surveys we look at, are very 
high and were high by March, and in fact are very 
much higher probably than in any other country in 
the world, and we can be quite proud of that. On the 
other hand, in terms of understanding what the issue 
really is about, I think we have not succeeded at all. 
I suppose that is an exaggeration. We have succeeded 
to a degree but I think there is a very large measure 
of misunderstanding. I make presentations, four or 
five a week—I made two in Edgbaston this 
morning—and everybody who comes to these 
presentations knows there is a problem and so they 
are aware of it but hardly any understand the issues 
and they go away rather shaken when they find out 
what this is about. So yes, we have been successful 
superficially. Iam pleased about that but we have not 
really been very successful when it comes down to 
really understanding it. 

(Mr Wirszycz) I think there is one area of 
misunderstanding which actually comes from the 
name which is often given to this issue, which is “the 
year 2000 problem”. In reality it is a 1999 problem 
because you cannot wait until the last minute, which 
is what most people do for the majority of their 
business projects, because the use of year 2000- 
related dates and processing will occur well before 
the year 2000. It is already occurring and we are 
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starting to see examples of failures occurring in 
various systems and I hear many anecdotes which in 
some ways I feel it would probably be unwise to 
present here because they have been passed 
secondhand. At the same time I think this action is 
just not early enough and that people, especially in 
smallish businesses, are waiting for their software 
suppliers and others to fix the problem for them and 
it does not just happen automatically. There is a 
degree of pro-action and planning that has to take 
place and that takes time. Upgrading anything is a 
more than trivial exercise in the IT world. So I believe 
itis a question of getting masses of people to act, and, 
if we have done any form of mass awareness 
behavioural change programmes in the past, the 
lessons are that it takes a lot of time, a lot of effort 
and a lot of resources to get everyone to do it. 


9. Do you have a crude assessment of what 
percentage of British industry is actually embarking 
on the action necessary to survive in the next 
millennium? 

(Mr Guenier) Yes, we have some quite good 
figures. There have been two surveys published quite 
recently, which is good, because until quite recently 
we had been relying to a large extent on anecdotal 
evidence, which is hugely unsatisfactory. There were 
two surveys, one that we carried out with the DTI, 
which was funded by a company called Sage 
Accounting Software, and this showed that 
something like—it was a really surprisingly high 
number—approximately 75 per cent of small- and 
medium-sized enterprises claimed that they were not 
only aware of the problem but understood it. That 
was good. However, only 10 per cent. of those 
companies have actually carried out a complete audit 
of their systems. I will give you some numbers at 
random. Fifty-seven percent. of those companies 
planned not to have any budget until 1999, which 
shows a total misunderstanding of the problem; 80 
per cent said they were going to do the job in-house; 
57 per cent had no people to do it with. So we have a 
very serious gap between people thinking they 
understand it and actually understanding it. As an 
example, we went to 50,000 SMEs and we had 
responses from 1,000, and I am told by statisticians 
that that means that those who replied were probably 
the better end and, therefore, the reality is worse than 
that. If you look at larger companies, our view is that 
probably only about 15 per cent, somewhere between 
15 and 20 per cent of larger companies actually have 
a full strategic plan in place. By “full strategic plan” 
we mean the following: we mean that, first of all, the 
chief executive and the board of directors are 
involved very much in running this project, they 
understand it and they have bought into it; secondly, 
that a full audit has been carried out, as Ian Hugo just 
said; thirdly, that that audit has been prioritised. In 
other words, you look at your systems and then you 
determine what your mission critical systems are, and 
incidentally, Chairman, some of those mission 
critical systems may be at another person’s 
organisation. You may well depend upon your 
suppliers or your customers or what have you for 
their systems to be compliant. So you list the things 
that are mission critical, then, Having done all of that, 
you put a budget on to fixing it and that can be a very 
large sum of money and it must be an adequate 
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budget. Having done that, you need to appoint a 
project manager who is going to run the project and 
a project team to see it through. I am talking about 
big companies. Our view is that only about 15 per 
cent of large companies in the United Kingdom have 
done all that and _ started the process of 
implementation. That is desperately worrying 
because when you have done all of that—and it is a 
big job, as you can tell—you have a mountain to 
climb, you have all the work to do, all of the 
conversion, all of the implementation, and as Ian 
Hugo said, all the testing still has to be done. We are 
in no doubt that now it is getting extremely late for 
those 85 per cent of larger companies. The best 
practice in the private sector established by 
companies—I think I can name a few, people like 
ICI, Shell, Smith Kline Beecham, Nationwide 
Building Society, British Telecom, who are 
companies that are really getting on with this—they 
have as their best practice to have the job completed 
by the end of 1998. There are good technical business 
reasons for that. Because they know that computing 
jobs nearly always run late, they are aiming to do it 
by about September. From today to September is 
about ten months and if you have not yet done that 
first step that I have just described now it is going to 
be very difficult indeed to complete the job in time. 
Therefore, we are going into an emergency. 


10. So bigger companies are preparing but small- 
and medium-sized companies perhaps less so? 

(Mr Guenier) As I said, bigger companies are 
preparing but not nearly enough, and smaller 
companies are even worse. 


11. Finally, as it appears from these answers that 
there is still widespread complacency and ignorance 
on the part of business and time is running out, is it 
not now too late to require voluntary action, which 
is the purpose of Taskforce 2000? Is there not scope 
here for a unique piece of legislation to respond to a 
unique issue, as I proposed in my Private Member’s 
Bill, which will require company directors to 
undertake an assessment and to report back the 
outcome of that assessment to the owners of the 
companies, the shareholders, in the annual report for 
just one year only? 

(Mr Guenier) I am inclined to think that that is not 
the appropriate way forward. I think the problems 
with legislation are, first of all, the time involved in 
setting the legislation up, which IJ think is probably 
rather late now, and secondly, I fear that drafting 
that piece of legislation in a satisfactory way would 
be extremely difficult. One of the problems, 
Chairman, as I said a moment ago, is that it is all 
about prioritisation. People have to determine what 
needs to be done. There are some jobs you can 
abandon, some jobs you can cancel, some jobs you 
can defer, and it seems to me that a sensible board of 
directors will have to take account of its own business 
priorities and those it knows about, and it seems very 
difficult for me to see how a piece of legislation can 
be drafted to make that happen. I do not know 
whether you agree with that. 

(Mr Wirszycz) I think that maybe the auditing 
boards, the auditing faculty of the Institute of 
Accountants of England and Wales have actually 
issued some guidance to auditors especially for the 
year-end accounts coming up, which indicates how 
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they should treat this in each company to look at 
them as a going concern, and we believe that that 
kind of action will certainly affect every private 
company in the land. 


Dr Gibson 


12. Let us turn now to government departments 
themselves. In your experience, is enough being 
done; what is still to be done; what should be done; 
and are they going to miss their deadlines for the 
year 2000? 

(Mr Guenier) Taskforce 2000’s brief is to address 
the private sector, so we are not directly involved 
with the public sector at all. I think I have to say that. 
I do sit on the Government’s Year 2000 Action 
Group, which is the public sector group, and I feel 
that in some ways my view about it is something 
which is somewhat confidential. I do not know how 
I should deal with it at this meeting but my general 
view is as follows, that it seems to me that 
government departments are lagging behind best 
practice in the private sector, and I stress best 
practice, the companies of the sort I mentioned a 
moment ago. On the other hand, all the government 
departments do require a programme. They have a 
teannin place. They do attend regular meetings. They 
have milestones set for them and they do have access 
to the CCSA’s very expert help. So on the one hand 
they are lagging behind the best practice but, on the 
other hand, there is a much more universal approach 
in the public sector than in the private, because the 
worst practice in the private sector is disastrous and 
that certainly is not true in the public sector. So that 
is a very general answer. 


Chairman 


13. That is the private sector, is it? 

(Mr Guenier) | am sorry, my comment was that in 
the private sector the worst practice in the private 
sector is considerably worse than the worst practice 
in the public sector. The point I wanted to make is 
that there is a uniformity of approach in the public 
sector which does not exist in the private sector. 
However, the best practice in the private sector is 
light years ahead, in my judgment, than in the public 
sector. If you look at large departments of state, who 
have an enormous job to do, they are far behind some 
of the big corporations who are getting on with this, 
and what disturbs me, Mr Chairman, is that when I 
talk, as 1do commonly, to the boards of directors of 
large companies who are getting on with it—I want 
to stress that—they commonly say to me that they 
are very concerned they may not be able to complete 

the job on time, for various reasons. They will 
probably complete the main part of the job on time 
but they are very concerned about their supply 
chains, they are concerned about third parties and so 
on, and if a company which has been dealing with it 
for two years is concerned and they are two years 
ahead, as I suggest, of some government 
departments, it does worry me that those 
government departments have severe problems, 
because plainly they have the same problems as large 
companies. 
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14. Is the secrecy you feel uncomfortable divulging 
about which departments are really behind? 

(Mr Guenier) I could not answer that. I do not have 
that information. 


Chairman 


15. Mr Wirszycz, I think you wanted to make a 
supplementary answer, did you? 

(Mr Wirszycz) Yes, briefly. My day job is that I 
represent a great many companies who provide 
services to Government and I believe that the 
message that is coming through to me is that very few 
government departments are actually issuing 
contracts for help, and the message may come back 
that they are clearly doing it themselves. I see in my 
contact that there is not a great deal of urgency in the 
matter. That is something that does concern me both 
as a citizen and as someone who consumes 
Government services. I believe this is so important, 
especially in parts of Government where there is not 
centralised control and where effectively a great 
many decisions are taken by a great many people, in 
the health service, police service, local authorities. 
That dispersal of authority, I think, means that you 
are going to find a great deal of variety in how things 
are done and I think that that urgency could, indeed, 
provide leadership for the rest of the economy if it 
existed. 


Mr Jones 


16. If I could just tag on to the end of the public 
sector problem, we heard the estimate that the cost to 
the clearing banks was half a billion pounds to put 
this problem right. Do you have any feel for what the 
cost is going to be to Government? 

(Mr Guenier) Yes. I have been quoted as saying it 
will cost the British economy £31 billion to resolve 
this matter. That is not actually what I said. I will 
come to your question in a moment. What I said was 
that if you take the best practice in the private sector 
and extrapolate that across the whole of the 
economy, youcome to a figure of £31 billion, broadly 
speaking. The fact is that is completely impossible. 
The IT industry does not have the resources to meet 
that and we do not have the time to spend it even if 
they did. But if that were true, the figure in the public 
sector would be of the order of about 6, in my 
judgment. Now the same applies to that 6. There is 
not the resource and there is not the time to spend it. 
That, of course, is a matter of very serious concern 
because it means that items are not going to be 
properly done and that, therefore, underlines the 
point I made a moment ago about the need for 
radical prioritisation. It is essential we do not try and 
do everything and we do do the things that really 
matter. That requires very senior level leadership, in 
my judgment. My guess—and it is a pure guess—is 
that the proper bill for the public sector would be in 
the region of £34 or £4 billion, which, incidentally, is 
not unadjacent to the figure which the Labour Party 
were suggesting in opposition. Therefore, I think the 
present estimates that we are now seeing are likely to 
be far too low and if you relate those estimates to, for 
example, the clearing banks, then it does not really 
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make sense. Why should there be any difference 
between the best practice in the private sector and the 
best judgment at present in the public sector? 


17. Can I move on to suppliers. I used to work for 
a supplier. This is a problem created by the IT 
industry. We heard from the British Computer 
Society. They told us that “the current IT business is 
simply chaotic in structure” and “there are no 
effective professional or regulatory bodies”. We also 
heard today in your own submission that 80 per cent 
of deadlines are missed. Is there a problem in the 
industry? 


(Mr Guenier) Could I invite Mr Wirszycz to 
answer that question. 


(Mr Wirszycz) I am not sure I understand the 
problem. 


18. Does the industry have a bigger problem than 
just this millennium bug? Is it just anarchy out there 
in computer systems? 


(Mr Wirszycz) It is a very entrepreneurial business 
environment and has thrived extremely well. I think 
I would take issue with one of the things you said, 
that the IT industry has actually caused this entire 
problem. It has certainly been involved but I 
certainly would not believe that the supply industry 
has been responsible for this. More than three- 
quarters of all the code that is affected here has 
actually been written by organisations in-house and, 
therefore, I would suggest that there is a great degree 
of culpability which exists throughout the economy 
and not merely within the IT technical arena. I 
believe that there is a problem of plant. The IT 
plant—let us talk about it in terms of people in the 
United Kingdom—is about 600,000 people in terms 
of IT professionals, and that plant is probably set up 
to replace or, indeed, fix about a quarter of the 
systems that exist in the country if we say that people 
replace their IT systems every four years. It is not set 
up to handle the replacement and the fixing of all 
systems within one year and, therefore, as Robin 
suggests, I believe we are going to call upon those 
who actually are responsible for these systems to 
radically prioritise what can be done and what ought 
to be done in the time and with the resources that 
actually exist. But I believe the IT industry has tried 
to put together services. Several of my larger 
members have indeed put together extensive service 
arms, centres of excellence, if you like, and they have 
been shocked by how little take-up there has been of 
that. Indeed, in two of the companies that probably 
were best set to help, less than 10 per cent of their 
business is accounted for by discrete year 2000 work 
currently, which probably indicates in a sense that 
this is not being treated early enough by enough 
organisations and in many cases there is not spare 
resource left any more. 


19. Can I ask you about the equipment that is on 
sale now. How millennium compliant is it? If you go 
into Dixon’s and buy a PC, is it going to go bang? 


(Mr Wirszycz) It may. 
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Chairman 


20. It may? Even now? Something on sale now? 

(Mr Guenier) Mr Hugo is something of an expert 
on that and I will ask him to answer. 

(Mr Hugo) It depends what you mean by “fail” in 
terms of getting the date wrong. Yes, nearly all 
equipment, nearly all PCs at the moment will fail. 
One of the suppliers, Compaq, is prepared, and has 
said it is prepared, to give a written guarantee either 
that its equipment will not fail or that it will fix it free 
of charge. That seems to me a responsible approach 
but the fact is that, although components are now 
being made that will not fail, by the time these 
components are assembled into machines that go 
through the warehouses and into the shops, that will 
take some time. The machines currently being sold 
are generally not compliant. 


21. Have we not known of this problem for 18 
months, two years, if not longer? 
(Mr Hugo) Yes. 


22. The IT industry, we have just learned from Mr 
Wirszycz, is almost whiter than white, but surely they 
are not if they are taking this long to do anything 
about it? This really must be the IT industry’s 
responsibility? 

(Mr Guenier) Could I try and help, Chairnian. I 
think we have to look at the computing profession as 
a whole. This problem evolves, as you know, from 
the use of two digits to represent the year, which 
made very good sense when it happened in the Fifties 
and Sixties—I should say the 1960s; maybe I should 
use four digits as well!—but it became a practice and 
it was a practice within the supply industry but also 
a practice, as Mr Wirszycz says, in the user industry. 
So all the computer so-called professionals have a 
part in it. Therefore, I think it is very difficult to 
allocate blame to vendors or users. That is the point 
I would make in commenting on Mr Wirszycz’ 
proposal. It is to my mind, though—and I am not a 
computer person at all—quite extraordinary that the 
use of two digits continued through into the 1980s 
and into the 1990s. It seems amazing that that 
happened and the thing is frankly bizarre. 


23. But you are moving away from my point. My 
point is that since we have known about this for over 
two years, why were not urgent steps taken by the 
computer manufacturers to make sure that at least all 
equipment purchased after 1995 was millennium 
compliant, and if equipment is being replaced every 
four or five years, a large proportion of equipment 
would have been replaced by the year 2000? 

(Mr Guenier) It is extremely difficult to answer that 
question. 


24. Do profits have anything to do with it? 
(Mr Guenier) I do not have a clear answer. 


25. I think Mr Hugo thinks profits have something 
to do with it. Sell obsolete equipment and sell more 
later. 

(Mr Hugo) The computer industry is demand-led, 
like many other industries, and there are many things 
that users require at one time. If there was not the 
demand for compliance, as there was not two years 
ago, why should the computer industry provide it? 
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Mr Jones 


26. Do you think we need the Government to take 
some action? I have asked John Battle, the Minister, 
if he is going to ban the sale of non-compliant stuff. 

(Mr Wirszycz) I would like to add a point here. I 
think there are so many definitions of what 
“compliance” actually means that I think we have a 
slight problem. I think also, to get the PC issue into 
some sort of perspective, we are not talking about 
computers melting or malfunctioning. We are talking 
about by and large the majority of the problem with 
PCs is that you will need to reset the date of the clock 
on your PC, so let us put this in perspective. We 
certainly, as representing the software and services 
industry—and we do not represent the entire 
industry—believe that we cannot condone the sale of 
anything which would not work beyond the year 
2000, certainly even in the last year. Indeed, we have 
issued guidelines to the industry and codes of practice 
for that particular matter. Of course, we are an 
unregulated industry and it is very difficult to 
regulate anyway. There are 2,300 companies that 
build PCs in this country and I would say the very 
best, and those that actually supply the most, are 
indeed as clean as one could possibly be but you will 
find a great deal of variety across the industry. It is 
unregulated and that is how, in a sense, it is. It is very 
difficult to compel people because you cannot find a 
definition of what they ought to comply with. It is 
very difficult indeed. 


27. Do you think that current legislation is 
adequate for what is going to happen? Given that 
some systems are going to fail, who is going to be 
responsible? Is the Sale of Goods Act in a sufficiently 
advanced state that it is able to cope with questions 
of liability from the year 2000? 

(Mr Guenier) The question is, should Government 
be doing more to— 


28. Do we need to change the Sale of Goods Act? 

(Mr Guenier) I think in many ways the current law 
deals quite well with this problem. I think changing 
the law, rather as I said to Mr Atkinson, is probably 
too late now. There are great problems of definition 
again, as Mr Wirszycz said. There is a danger of over- 
concentration on the personal computer, if I may say 
so. lam not one to denigrate it. It is a very important 
problem and we do not have time to go into the detail 
but there are levels of compliance in the clock, in the 
computer, in what is called the BIOS, in the 
applications, in the operating systems, in the 
networks. It isa very complex subject and I think it is 
very difficult to say precisely what compliance means. 
For that very reason it would be very hard to bring 
in legislation to deal with it. The Sale of Goods Act 
deals with this in principle quite well, and my 
judgment would be, in view of the shortage of time, 
live with that. What I think Government could do— 
if I may make this point, Chairman—is rather than 
legislate, I would like to see Government 
emphasising the seriousness of the matter. The 
problem we have is that senior people in the private 
sector, and IJ dare say also in the public sector, simply 
do not regard this as a serious enough matter. It is not 
on the agenda of top people and when top people 
have it on their agenda, they drive it through. I have 
no doubt when I talk to large companies, the ones 


who are getting on with it, the chief executive regards 
it as his responsibility and he drives it through. He 
puts good people on to it, he puts budget on to it and 
sets priorities and so on. They do not see that 
happening in Government. This is our real concern. 
They do not see Government taking it seriously 
enough at a senior level, and we think that this 
problem is best resolved by tackling it that way, and 
we think that my point about prioritisation. within 
corporations also applies to prioritisation within the 
economy. We would like to see a much stronger lead 
in Government to tackle these fundamental issues, 
which I think would do a thousand times more than 
amendment to the Sale of Goods Act. 


Mr Beard 


29. I do not quite understand the answer which you 
gave earlier. Earlier on you said that there were 
something like 57 per cent of small businesses that 
had not the means of carrying out the audit and 
remedying the position. You also said that we in this 
country were probably in the lead in making people 
aware. So you could make people aware but if there 
is no remedy for them there, what do they do about 
it? What do these 57 per cent of small businesses do 
if they are aware? 

(Mr Guenier) I think you may have misunderstood 
my comment. I did not say they did not have the 
means to do it. What I said was that 57 per cent of 
small businesses did not propose to set up those 
means until 1999. I believe those companies in most 
cases would be able to tackle it if they understood the 
priority that existed. 


30. Many small businesses would not have the 
capability internally to do it, so what could be done 
for them? 

(Mr Guenier) 1 think there is a very real problem 
there. There are various ways that this can be tackled. 
My own personal view is that the best way this is 
tackled is by companies who have the problem 
coming together and sharing their experience. I have 
seen a number of cases of these self-help interest 
groups working together, finding common solutions, 
finding common approaches to consultants, and I 
would very much like to see that whole process of 
common approach being expanded throughout the 
economy. But this is not going to happen until senior 
people put it on their agendas. This is not going to 
happen from the IT manager taking the initiative 
himself. There is another point I really ought to 
make, Chairman. When we talk about PCs I say we 
are slightly misunderstanding the computer problem. 
When we talk about the computer problem we are 
tending to overlook the extraordinarily large 
problem with embedded microprocessors, which are 
not regarded as computers at all. Mr Wirszycz said, 
for example, there are 600,000 IT professionals in the 
British economy, a very large number—more than I 
thought actually—but I am told there are only 20,000 
process control engineers in the United Kingdom. 
You need specialists to look at the microprocessor 
problem. There are literally billions of these devices 
throughout the economy. Shell tell me that a typical 
North Sea rig has 10,000 microprocessors in it, each 
one of which has to be looked at. Some of them are 
under the seabed. It exists throughout the health 
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service, it exists throughout all process industries, it 
is in air traffic control systems and, of course, at home 
it is in your fax machine, your video recorder and so 
on. These devices are everywhere and that is a very 
large problem which is hardly being addressed 
properly at all. 


31. But does that not mean it is not just a matter of 
awareness, which is what you have been stressing and 
suggesting even more emphasis should be given to 
that? It is the matter of the capacity for action which 
is also at issue? 

(Mr Guenier) That is partly true. I think I would 
say this. We said at the beginning there is a difficulty 
of definition of “awareness”. My background is that 
I am a general manager, I am a businessman. My 
view is that when senior people understand that 
something has to be done, then they get it done. If 
they understand that their businesses may not 
survive, they will make sure it does survive. 


32. Not if the resources are not there, if the skills 
are not there or the capital is not there. What was said 
was it may need fixing or it may need replacing. If it 
needs replacing it requires capital? 

(Mr Guenier) Of course it does. I quite agree with 
that. What I said also was that it is a matter of 
prioritisation, and if people recognise this is a No. 1 
priority, because otherwise they do not survive, those 
people will then stop doing other things they are at 
present spending money on because they have to be 
seen as secondary. This is the best approach. This is 
how you liberate people to get on and find the 
resource. Of course, we and Government and others 
can do something to help, but the fact is that if 
individuals know it is important to tackle it, they will 
find a way. That is my own personal view. 


Mr Jones 


33. Could I ask very quickly a technical question. 
I understand there are lots of embedded chips in the 
nuclear power industry. Is there enough time to close 
down nuclear stations in order to fix everything? 
Would not the national grid have some demand on 
the amount of electricity that is generated by the 
nuclear industry? 

(Mr Guenier) I cannot provide a definitive answer 
to that question. The answers I get from the nuclear 
power industry are that they are confident that they 
can fix it. You may say, “They would say that, 
wouldn’t they?” I suspect that they are very aware of 
this because they have the process of safety critical 
matters foremost in their minds always, irrespective 
of this problem. I know the nuclear power industry 
has been working on this now for some time and the 
statements I hear are reasonably optimistic; therefore 
I can only conclude they believe they can do it, but I 
suppose in the back of my mind I share your doubts 
and I really do not know more than that because I do 
not have time to go into the detail of how the nuclear 
industry are tackling this. We are a very small 
organisation. 
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Dr Jones 


34. In claiming to ensure that millennium 
compliance has been given the priority it should have 
deserved, have not you in Taskforce 2000 failed to 
achieve your objectives; could you have done more 
and what has prevented you doing more? 

(Mr Guenier) As I said to Mr Atkinson, I believe in 
terms of a very harsh interpretation of the word 
“awareness” we have. There is no question about 
that. The job, of course, is enormous and we have 
been setting out with tiny resources. I calculated that 
we have cost the public purse, if you were calculating 
on eight-hour days and five-day weeks, £100 an hour 
since we started, which I suggest is a rather small sum 
for doing a massive job right across the economy. So 
we can take some pride, I think, from the general 
levels of awareness, but I agree that the 
understanding of the issue is certainly not deep 
enough, and my present concern is that that 
understanding that very much needs to be put into 
the minds of senior people today is in danger of being 
put off a little by current changes in the 
Government’s approach to this. So I think that yes, 
you are right, more needs to be done, more should 
have been done. As I said in my evidence, I believe 
that the last Government and the present 
Government really should have put more resource 
behind this, and I told both Governments that that 
was the case. We have had tremendously good 
support from the DTI and I am very grateful for that, 
but the fact is that the funding has been tiny and we 
have been doing it with a handful of people. I did not 
even have a secretary until August of this year. This 
is a tiny little cottage industry. So I think it is rather 
hard to expect a cottage industry to do this massive 
awareness campaign that is needed and I have very 
clear views and have made very clear proposals about 
how it should be done and they have not been able to 
be implemented. 


35. Could you tell us, if you had the resources, 
what you would have done and how we actually 
catch up on that? 

(Mr Guenier) I believe the following, something 
which we have said before. I believe that the No. 1 
help would have been very senior support from 
Government. I think if Government itself were seen 
to be giving this priority at the most senior level, that 
would make an enormous difference to people’s 
perception of the issue. That is the first thing that I 
really think needs to be done. Secondly, the view that 
we have had now for some time is that we think 
funding should be available for a very highly focused 
advertising campaign, similar to the AIDS campaign 
or the self-assessment campaign, which would be 
done by professionals and would focus this issue 
clearly on to the people it needs to target. I think 
those two taken together would make an enormous 
difference to our understanding of the position and I 
still believe now that is the way to tackle it. 


Mrs Spelman 


36. I want to ask you about what seems to the 
layman to be an apparent duplication between 
Taskforce 2000 and Action 2000. Why do you think 
the DTI thought it necessary to create a separate 
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organisation and how do you envisage Action 2000 
and Taskforce 2000 working together in the future? 
You give some indication in your evidence to the 
Select Committee that there is a detrimental impact 
upon Action 2000 of what Taskforce 2000 has 
already done. 

(Mr Guenier) The answer to your first question is 
that I think you should ask the DTI. I cannot tell you 
why precisely Action 2000 was set up. Let me say this. 
The function of Action 2000 is very welcome, the 
process that it appears to be addressing of things we 
have been asking to do since the beginning of 
Taskforce 2000. When Mr Wirszycz and I set up 
Taskforce 2000 we had an agenda of things we 
thought we would like to do and that agenda pretty 
well embraced the present objectives of Action 2000. 
That was 18 months ago, so we cannot possibly 
criticise them, we have been asking for them for some 
time. So that is welcome. The problem we have is that 
the amount of funding available to do that is 
probably inadequate to do just that. We believe the 
first priority has to be to get the message across to 
senior people in the private sector, because unless 
those senior people are doing something, unless they 
know they need help, they are not going to ask for it. 
Our fear—and it is only a fear at the moment because 
we are discussing these matters—is that the process 
that we are now carrying out—and I think it has been 
quite successful given our limited funds—the 
momentum we have created is likely to be diminished 
by a lack of funding, and the indications that I have 
had from the DTI are that our funding will be 
finished when our present amount runs out, that our 
present programme will stop. I think to stop that 
present programme would be unwise. Therefore, I 
suggest that the bringing in of Action 2000, although 
the detail is welcome, is not very welcome to what I 
believe is the first priority. 


Mr Atkinson 


37. In view of what you have just said, you may not 
wish to comment on this but I understand that the 
Chairman of Action 2000 is only going to spend one 
day a week in that role right up to 31 March 2000. 
Surely one day a week is totally inadequate in 
response to the problem? 

(Mr Guenier) I do not necessarily agree with that 
because, supposing he were my Chairman, as Mr 
Wirszycz is my Chairman, I would not expect my 
Chairman to spend even one day a week. Mr 
Cruickshank is going to appoint a director. The 
director will be doing the equivalent job to the one 
that I am doing and the director has to be the boss; 
the director has to run the show. So I think it is 
perfectly proper for a Chairman to have a part-time 
role. So I think the press has misunderstood that. Ido 
not really have a problem with that at all. The 
difficulty, of course, is that there is a hiatus now while 
the director is being appointed and this may take 
some time, and just at the moment this is such a 
critical issue, where we are looking literally at weeks 
within which these 40,000 companies have to be 
turned around, that we cannot afford a hiatus of even 
two days let alone two months. That is my concern. 
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Dr Turner 


38. You have asked the Government to put a 
higher priority on your activities, so what more do 
you think the Government can do to help the 
industry and the public prepare for 2000? What way 
do you think the Government can give a higher 
priority? 

(Mr Guenier) I think, as I have said already, the 
most important thing, the one thing I would welcome 
enormously, would be for the Prime Minister to 
make a statement about the importance of this issue. 
I think if it were seen to be a matter at Cabinet level, 
it would be extremely important. 


39. So it would be a purely political process? 

(Mr Guenier) I think the reason for that is that if 
that were to happen, it would be seen to be important 
by those who make the decisions. That would be my 
answer to that one. 


40. So you do not think, then, that further 
Government spending is an answer to the problem? 

(Mr Guenier) Of course, Government spending is 
an additional thing. As I said a moment ago, I think 
the actions that are being set forward for Action 2000 
are very welcome and that will take money. I think 
there is a need for an advertising campaign. That will 
take money. I think there is a very good need for 
some sort of regular research to be done, funded by 
the Government, so that we can see where we are and 
are not relying upon anecdote. All these things take 
money, so of course I think that further funding is 
required. 


Chairman 


41. We have already discussed the skill shortage 
and you have brought it to our attention, so I will just 
ask one question. We know that there is a lot of effort 
going on in business and commerce at the moment 
thinking about the possibility of a single currency, 
and there must be a lot of IT effort in that. Do you 
think, Mr Guenier, that the effort going into 
preparing for a single currency as far as the IT is 
concerned is reducing the amount of skill there is 
available for this particular problem which we are 
discussing today? 

(Mr Guenier) My personal view is that I have not 
the slightest doubt that it is. I think that the 
introduction of the euro is having a major impact on 
resolving the year 2000 problem. My personal view is 
that the single most potent reason for deferring the 
euro is the fact that the year 2000 is happening at the 
same time. The key dates for both are actually 1 
January 1999. We are doing the largest IT job we 
have ever done and the second largest IT job we have 
ever done at the same time, and the computing 
industry, I regret to say, has a very bad record of 
delivering on large projects; it is nearly always late. 
To do two at the same time seems to me to be 
remarkably foolish. That is my view. 
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42. Who internationally would you say is best 
prepared for the millennium and what have they 
done that we have not? 

(Mr Guenier) I doubt, frankly, that anyone is 
better prepared than we are, which is an 
extraordinary thing for me to say in view of the 
points I have made. One journalist said to me that he 
believed that Britain was leading the pack. I said, 
“Could you please direct me to another pack?” If we 
are leading, then I fear—and I seriously mean that. I 
think probably more is being done, arguably more 
may be being done, in the United States, but a recent 
study of Fortune 500 companies in North America 
showed that only 16 per cent of Fortune 500 
companies had an adequate strategic plan in place. 
Those data were taken in August. So I do not believe 
there is much chance that the United States is ahead 
of us and I am almost completely sure nobody else is. 
So the answer to your question is the world has a very 
serious problem. 

(Mr Wirszycz) If I might add a supplementary in 
relation to the euro question you asked, I believe the 
situation in Europe is actually quite lamentable and 
certainly my contacts throughout — similar 
organisations and others across the industry in 
Europe suggest to me that they have been looking at 
preparing for the euro ahead of year 2000 and the 
year 2000 capability within major economies in 
Europe is extraordinarily poor. 


Dr Jones 


43. Following on from that, what problems are we 
likely to suffer as a result of the failure of other 
countries to prepare for this? 

(Mr Guenier) I think the problems could be very 
severe. We live in the cliche of a global economy 
today and if we were to fix our systems but our 
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trading partners did not, we could be very seriously 
damaged. For that reason, another initiative I would 
like to see the Government taking, particularly as 
they are taking on the Presidency of the European 
Union this year, is to give the matter far more 
prominence on the international stage. 

(Mr Hugo) The Chief Economist of Deutsche 
Morgan Grenfell has been quoted as saying that he 
believes there to be a 40 per cent probability that 
globally we will face a recessive financial situation 
similar to that in 1973-74 after the oil crisis. 


Chairman 


44. Thank you very much indeed, gentlemen, for 
your contribution this afternoon. I have before me, 
Mr Guenier, your press release of what you were 
going to say to this Committee. I am pleased to say 
that now that you have mentioned that the Prime 
Minister should take a lead, you have kept well to 
your script, and the hard-hitting assessment that you 
were going to give us has been delivered in every 
detail. I would just ask in future, if you were to give 
a press release on your activities before Select 
Committees of this House, that you would make the 
embargo time the end of the Committee and not the 
beginning of the Committee. 

(Mr Guenier) I note that, Chairman. 

Chairman: With that reservation, may I thank you 
very much indeed, all three of you, for your very kind 
and helpful assistance to the Committee. 


Memorandum submitted by Action 2000 


SUMMARY 


1. Action 2000 has just been set up by the Government to help private businesses tackle this serious 
problem. Most businesses are aware of the problem, but too few are taking action. The problem is urgent. 
Action 2000 will be stimulating a range of collective activities in partnership with other organisations, 
particularly directed at medium and small businesses which need external help, and at tackling the shortage 
of IT skills. 


2. Responsibility for avoiding the century date problem rests with the business, Government Department 
or other organisation which relies on a computer or electronic system. The remit of Action 2000 concerns 
systems in private sector businesses and this Memorandum does not address the public sector or 
consumers’ systems. 


3. This Memorandum responds to the letter received on 3 November 1997 and deals with the issues in turn. 


(i) The nature, magnitude and implications of an inability to manage the date change in personal and 
mainframe computers, embedded systems and software, especially where such computers are 
performing safety critical operations 


4. It is clear that if no action were taken to deal with the problem, many systems would malfunction with 
very serious consequences foy the economy and society. Businesses large and small depend increasingly on 
computers for their operations, and few have adequate resources to handle those operations manually. In 
addition, there is a very wide range of electronically-controlled equipment, some of which will be affected. 
Widespread system malfunctions would be very disruptive. 
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5. Some malfunctions could be very serious, but others much less so. Given the pressures on resources and 
the shortage of time and of skilled people, it is essential to concentrate on systems which are critical for 
business performance, health and safety or the environment. Many systems will take a long time to tackle, 
but a few could if necessary be left until malfunction occurs. Senior managers need to set priorities. 


(ii) The effectiveness of action which has already been taken to avert problems in Government, large 
corporations and small businesses 


6. The business needs: 
(a) to check its critical systems; 


(b) where the problem is found, to fix the system, replace it, convert to manual operation or abandon 
the function; and 


(c) test the solution. 


All three steps must be completed before the system malfunctions. Systems which manipulate dates in the 
future—eg budget planning or forward ordering—will malfunction before 2000. 


7. Iam not aware of any systematic evidence about the effectiveness of action taken by businesses. The 
process of checking, fixing and testing takes time and only a minority of businesses have yet completed the 
process. Iam more worried about businesses which have yet to start. 


(iii) The role of Government in raising awareness of the potential problems and in seeking solutions and the 
respective roles (of) Taskforce 2000 and the recently launched Action 2000 


8. The Government believes it has a responsibility to bring the century date problems to the attention of 
businesses, to encourage them to take action, and to ensure that help is available, principally from commercial 
sources, but co-ordinated, signposted and supplemented by collective activities. 


9. The role of Action 2000 is: 


(a) to advise the President of the Board of Trade and the Chancellor of the Duchy of Lancaster on the 
state of preparedness of the private sector—particularly in key sectors identified by them—and to 
make such contribution to their work on contingency planning as they may require; 


(b) to advise the President whether the DTI should offer funding to other organisations; and 


(c) to draw up, agree with the President and implement through a separate company a costed 
programme of collective activities—Action 2000—to support businesses in the private sector in their 
efforts to tackle the century date problem. 


10. Advice to the Government will be provided by an Advisory Board, which I will chair, drawn from 
organisations which have a major part to play in helping industry tackle this problem, and from other 
individuals. I was appointed by the President of the Board of Trade. I will appoint the other members of the 
Advisory Board, after consulting her. 

11. A separate company will be set up to help devise and implement the programme of activities. Many 
of the activities will be carried out in partnership with organisations such as trade associations, professional 
engineering institutions and Business Links. Government Departments, Regulators and individual 
companies also have a part to play in helping the private sector tackle the problem. 


12. In all this the purpose of Action 2000 is to pull together the efforts and resources of other organisations 
into a coherent whole. We will be encouraging businesses and other organisations to participate and I shall 
be persuading senior people to support the initiative. 


13. Action 2000 intends to undertake or promote others to undertake a wide range of activities, which are 
expected to fall under the following broad headings: 


— Promotion—activities to promote the importance of the issue and signpost help. 

— Advice and Guidance—identifying and providing available best practice, advice and guidance. 

— Assessment Schemes—providing self-assessment conformance tools for users, consultants and 
suppliers. 

— People and Skills—develop and implement ways to address the current shortage of skilled IT 
staff. 

— Tools and Techniques—make available details of tools, techniques, products and services. 

— Practical help and advice for small and medium sized businesses. 


In addition, I would expect to advise Government on how existing programmes might be targeted on the 
century date problem, and on the adequancy of preparation and contingency plans of key sectors of the 
economy such as telecommunications and electricity generation. 


14. Taskforce 2000 has been asked to give evidence on its activities. It is one of a group of organisations 
which have submitted proposals to Action 2000 which we are currently studying. Action 2000 will seek to 
build on its achievements. 
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(iv) The extent to which new systems and software are “millennium compliant” 


15. The Computer Services and Software Association maintains a database about software products. 
Action 2000 will be considering how information can best be made available about computer hardware and 
about other electronic equipment. Action 2000 is also considering proposals for self-assessment schemes. 


16. Compliance is a complex matter. It depends on the hardware, operating system, application software, 
data—including data imported from other organisations—and user behaviour all being compliant. It is also 
possible for a system to be non-complaint in trivial ways: we need to focus on non-compliance which will have 
serious consequences. 


(v) The development of contingency plans in the event of system and program failures 


17. Every business dependent on systems is responsible for developing its own contingency plans against 
the possibility of failure of critical systems. Government may need to consider whether contingency planning 
is necessary on a national basis, and Action 2000 stands ready to contribute to this by gathering information 
on the state of preparedness, particularly in key sectors. 


(vi) The legal implications of disputes over liability for compliance costs and system and program failures 


18. It has been suggested that businesses might delay taking action while arguing with suppliers about who 
is to pay. It is part of our message that businesses cannot afford to delay. Whether or not a supplier has 
liability, ultimately it is the business which is responsible for ensuring the effectiveness of its operations. 


Ql. What is your estimation of the seriousness of the millennium bug problem? 


19. As indicated above, the problem would be very serious if no action were taken. Many larger businesses 
have been engaged on the task for some time, and given adequate budgets there is sufficient time for them to 
fix it. At the other end of the scale, the smallest businesses are less dependent on computer systems. The main 
area of concern is medium sized businesses which may not appreciate the extent of the threat, have failed to 
start early enough or commit adequate resources, and could have a significant impact on other businesses in 
the supply chain if they are unable to cope. 


Q2. To what extent do you think that businesses and other organisations in the UK are sufficiently prepared to 
handle the date change? What is your evidence for this? 


20. Awareness of the problem is now much more widespread amongst businesses. In a recent survey 
undertaken for Sage and DTI, 97 per cent of respondents said they had an understanding of the business 
implications. 

21. This indicates a significant improvement since surveys conducted over the last year, reflecting the more 
extensive media coverage and activity by Taskforce 2000 and many others. 


22. The Sage survey paints a less encouraging picture of what businesses are doing about it. 55 per cent of 
those who responded had completed an audit of at least some of their systems, and are thus in a position to 
take timely action. We would hope that they will do so. Those who have started on their audit or are about 
to do so should be able to catch up. But there are many others who have no plans for an early audit—and 
the proportion may be much higher than indicated by those who bothered to respond to surveys. 


23. Action 2000 will be commissioning systematic and regular surveys to improve our knowledge. 


Q3. How does Action 2000 intend to carry forward the work of Taskforce 2000? To what extent will the two 
organisations be working together? 


24. Covered under point (iii) of this Memorandum. 


Q4. What do you see as the main reasons why more has not been done to avert computer failures at the 
millennium? 
25. The following factors seem to be inhibiting progress: 
(a) a mistaken belief that the problem only exists in old mainframes; 
(b) a failure to appreciate the urgency of the task; 


(c) a mistaken belief that someone else—a system supplier, a lawyer, an insurance company or the 
Government will sort it out; 


(d) a mistaken belief that a “silver bullet” will be invented which will fix the whole problem 
automatically (the reality is that tools to address different aspects of the problem are improving but 
will not avoid significant effort in applying them); 
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(e) reluctance on the part of some technologists to expose the extent of the problem to senior managers 


ignorant about technology; 


(f) inability to tackle the problem without external help, coupled with distrust of consultants, 
inadequately signposted sources of help and reluctance by some suppliers to take on more work in 


this area; 
(g) shortage of IT skills. 


26. Action 2000 will need to address all these factors but will be placing particular emphasis on the last two. 


Q5. Do you consider that there is enough time available for the majority of organisations to take steps to avoid 
problems at the millennium? To what extent do you think that it will be necessary for contingency plans to be 
drawn up? What will be Action 2000's role in that process? 


27. There is time for every business to assess its systems, prioritise and act on the most critical systems. 
There is also time to draw up contingency plans. Action 2000 will encourage businesses to this, and stands 
ready to assist the Government if it undertakes contingency planning at the national level. 


28. I have consulted the Department of Trade and Industry and the Cabinet Office in preparing this 


Memorandum. 
14 November 1997 


Examination of Witness 


Mr DON CRUICKSHANK, Chairman, Action 2000, was examined. 


Chairman 


45. Mr Cruickshank, thank you for being with us 
this afternoon and helping us with our inquiry. Can 
I start straight away by asking you if you think the 
headlines we have seen, such as “The millennium 
time bomb” and “IT doomsday” and other such 
fearsome headlines are overstating this problem, or 
do you think we really do have a problem with 
millennium compliance of computers? 

(Mr Cruickshank) Thank you very much. The 
problem will increase in severity as time passes. As we 
stand, November 1997, my initial judgment is that if 
there is urgency, if chief executives who are aware 
act, if they are properly supported (and that is a 
particular reference to those who are running smaller 
businesses who do not have the necessary IT 
support), then the doom and gloom you refer to will 
not happen. The challenge for me is to ensure that 
chief executives of businesses are enabled to reduce 
the risk to an acceptable minimum and that in key 
sectors of the economy, like telecoms or electricity 
generation, where the Government has a part to play 
or the citizens would expect the Government to have 
a part to play, the necessary contingency planning is 
in place. Certainly my previous experience, ie since 
the spring, of developments in the telecoms industry 
suggests that will be the case. I have yet to enquire in 
depth in areas such as energy. 


46. We have received some evidence from Cap 
Gemini who say that one in ten organisations will fail 
to meet the deadline; in other words one in ten 
organisations will have the problem everyone fears 
will arise, and Cap Gemini tell us that could put 29 
per cent of our GDP at risk. Do you believe there is 
any likelihood of that happening or is that another 
scare story? 


(Mr Cruickshank) My response to that would be 
the same as my response to your first question. That 
is a specific example of the gloom and doom scare 
stories you were referring to in your first question, so 
my response would be the same. 


47. You are newly appointed to Action 2000, you 
have probably not had enough time to do all that you 
want to in the way of digging into the problem yet, 
but is the initial reaction you have formed one of 
optimism that the bulk of the work that has to be 
done in the next 26 months can be achieved? 

(Mr Cruickshank) I have been digging into the 
issue in telecoms, so I did not come to this post totally 
unversed. 


48. That means you can give me an even better 
answer then, does it not? 

(Mr Cruickshank) The telecoms experience is 
interesting, in that it is deeper in a sense in that the 
problem extends down the supply lines, and in the 
telecoms case across international boundaries. It is 
likely to take longer to resolve and is likely to take 
more resources than the telecoms industry 
considered even six months ago. My suspicion from 
my discussions with the community of those 
interested in this issue, is that the same is very likely 
to be true of other sectors of the economy. 


Dr Williams 


49. Just to get some kind of handle on the problem, 
in my reading for this session the figures quoted in 
newspaper articles were of the order of £1 billion, £3 
billion, as the cost to the economy. Mr Ian Hugo in 
the last session said that if we were insufficiently 
prepared then we could be facing a crisis as big as the 
1973-74 oil crisis and recession. On your 
appointment of one day a week, if I may ask you 
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specifically on that, it does strike me if the crisis is 
that large or that substantial, why is it your own 
appointment is not full-time with an army of at least 
100 people to fend off this oncoming crisis? 

(Mr Cruickshank) I have a number of responses to 
that. The first is that my judgment is that if there is 
that—and I will not repeat the answer to the first 
question—urgency and that awareness and that 
action, then the crisis will not be as you describe. The 
second is that the issues are likely to move towards 
being very difficult if the delay in the availability of 
skilled staff begins to become the critical resource. If 
I can turn to my appointment, the plan is to have a 
project team led by a director with probably five or 
six team leaders, some of whom are already active in 
solving the problem. My role is to act as leader of that 
team, as as it were chairman, to be the interface with 
Government and to advise Government, helped by 
an advisory board. My role is not to be active in the 
solution of the problem. I would also say that it is 
very important that all of us interested in this 
problem say to business, “This is a business 
problem”, the role of Government in this sort of area 
is limited and I cannot but imagine what the response 
of the chief executive of a small company, the owner 
of a small company, would be to the thought that the 
Government was actually going to turn up on his 
doorstep and do something for him. That is just not 
how this problem will be solved. This is about 
developing awareness in the minds of chief executives 
and owners of small companies in particular, 
enabling them to find easily best practice for 
resolving this, and doing as much as we can in the 
time available about the availability of skills; when 
they reach out and say, “I want X, Y and Z”, where 
are these people. That is what the Action 2000 project 
team is about. My role is guidance and interface with 
Government. 


Mr Atkinson 


50. You have just used the term “best practice” and 
I have been pursuing this issue in the House of 
Commons now for two years, as a result of which I 
have had a lot of approaches from the industry and 
others who feel they have got the solution to the 
problem. I would not know one from another 
because I am ignorant of the computer industry but 
surely there is, or should be, an agreed approach 
between the bodies concerned with this issue and the 
IT industry as to what steps should be taken? Is there 
such an approach— 

(Mr Cruickshank) Yes. 


51.—and are you embarking upon it? 

(Mr Cruickshank) Prior to my appointment that 
work had started and groups had been established to 
identify, classify, all the readily available advice and 
best practice and guidance so it is available to chief 
executives in terms of, “What questions do I ask the 
IT people”, so it is available to the IT people as to 
how to go about this. We are planning to publish 
that, both on paper and in Website form. The 
interesting issue is the extent to which that advice can 
be marked as being good/or indifferent. Does 
Government have a role here? Does Action 2000 
have a role in classifying whether something is good 
advice, good practice or useful— 
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52. Or cowboy? 

(Mr Cruickshank) This problem, with the amount 
of money floating around, is bound to attract 
cowboys. Let chief executives be in no doubt about 
that. I have not taken a view as to the extent to which 
Action 2000 can, as it were, brand what we think is 
good or indifferent. There are issues about our 
capacity to do that, about the liability which would 
flow from such judgments being wrong, et cetera, et 
cetera, but it is an issue I am focusing on. My present 
thinking is to provide, particularly small companies, 
with complete and comprehensive lists of what and 
who is available and to offer them, as it were, a health 
warning in terms of “Here are the key questions to be 
asked” rather than a branding of the tools or the 
consultants as being good, bad or indifferent. 
However, I have yet to come to a conclusion on that. 


53. I think we have the impression from what we 
have learned so far that the majority of businesses 
throughout the world, not just in this country, have 
not yet started the process to meet the deadline, 
which of course is central because you cannot move 
the deadline. What is your advice to them? Is it too 
late to start now? 

(Mr Cruickshank) No. In fact this is a type of 
business problem that they rarely face, and for some 
of them it is their biggest business issue, so it is never 
too late. Remember, the challenge to every business 
is to reduce the risk to a manageable degree. I think 
it is highly unlikely that the target of eliminating all 
non-compliant equipment is likely to be achieved, so 
it is managing the risk downwards. The key issue, as 
I begun to talk to people in the last two weeks, is 
getting it in the right position in the in-tray of the 
chief executive. 


54. Is it too late to avoid problems? Will we 
experience problems come what may? Are we are 
now talking about a damage limitation exercise? 

(Mr Cruickshank) No, I would not put it quite like 
that. I think substantially all the problems can be 
overcome. There will be non-compliant systems 
starting in 1999 probably, and therefore the activities 
the Government has already set in place, to have 
contingency plans not just for the delivery of public 
services like health but also in key sectors of the 
economy—telecoms, energy, transport and so on— 
are very important parts of the planning which has to 
go on in the next year or so. 


Mrs Spelman 


55. You have mentioned the problems extend 
down supply lines and across national boundaries; 
what will Action 2000 do to tackle supply chain 
issues which do involve more than one company or 
more than one country? 

(Mr Cruickshank) Let me deal with the internal 
ones first of all, ie internal to the UK. Talking to key 
players, key companies, in the main sectors—and I 
can talk about telecoms as an example, that is BT and 
a number of the other major telecoms service 
providers, talking back down the supply chain to 
companies like Nortel, GPT and others, and then 
back beyond them to deep into the IT industry— 
what has happened there, because that is a network 
industry, and this issue is absolutely integral to the 
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networks working, is a challenge from the customer 
end of the supply chain back down through the 
supply chain. I think we are going to see more of 
something that Reuters, which is an interesting 
company, did a few weeks ago, which is the large 
companies begin to feel they have the problem solved 
or almost solved and they will begin to say two 
things. They will begin to say to their customers, “I 
have a competitive advantage over the people who 
are competing with me who are not compliant, trust 
me”, and they will also be saying down the supply 
chain, “Look, we are compliant and we are damned 
if we are not going to be compliant because of your 
delivery to us, so please will you talk us through your 
compliance programme and please will you 
demonstrate your compliance to us.” My judgment 
is, from my discussions with big companies, is that 
that is beginning to happen. If I may offer an opinion 
from my business background, a lot of the relative 
silence in this area is about large companies not 
wishing to upset auditors, stock markets, investment 
analysts, customers, supply chains, before they are 
confident that they have the problem substantially 
cracked themselves. Hence there is a willingness to 
talk to me and others privately about the problems 
and programmes, but an unwillingness to talk 
publicly. I would be interested to hear the response 
of some large companies to being asked to appear in 
front of your Committee, for instance. So I think in 
the next six months we will see a lot of pressure from 
large companies down the supply chain, becoming 
more and more public as they become more and more 
confident they have solved the _ problem. 
Internationally, my only relevant experience is 
telecoms, where it is proving difficult and we need to 
be raising this issue both through the contractual 
arrangements between major UK carriers and 
foreign carriers, but also within the European Union 
initially, and I know Mrs Roche is planning to raise 
this issue at the next Telecoms Council on December 
lst with specifically that problem in mind. We do not 
know enough about what other countries are doing 
in an area like telecoms where it is really global. 


56. What will Action 2000 do to help the private 
sector in safety critical systems, such as North Sea oil 
platforms, to operate reliably after the year 2000? 

(Mr Cruickshank) Or before. 


57. Or before. 

(Mr Cruickshank) I may say one of my first 
impressions is that I should be called Action 1998 not 
Action 2000, because it is next year that these 
companies and Government itself needs to have done 
the substantial bulk of the work. There are two 
dimensions to my answer to that question. One is the 
contingency planning, the number of parts of the 
economy—I mentioned telecoms, power generation 
and so on—where the Government will want to be 
assured that there are contingency plans in place. I 
mentioned that before and I will be recommending to 
Government which these sectors are. I had not 
thought of oil coming ashore and I shall note that in 
my advice to Government. But other than that, they 
are typically being run by large companies which it is 
my present judgment are aware of and are at some 
point in the process of resolving this problem. I do 
not know company by company where they have got 
to but one of the research projects we have in hand is 
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to bench-mark, as it were, the current state of 
preparedness, and we will be doing that with 
particular focus on these key sectors of the economy. 
I guess health and safety issues perhaps lay behind 
your question as much as supply, and I know the 
Health & Safety Executive are working on the issues 
in that area. We will be building on a useful report— 
more than useful, I found it a very illuminating 
report—which the IEE produced and a note here 
from my colleagues says that there is an expectation 
that the report will be published on 8 December and 
will address some of the health and safety issues 
arising from the buried systems problem as distinct 
from the computer failure problem. 


Mr Jones 


58. Will Action 2000 be paying particular attention 
to problems associated with embedded chips? One of 
our previous witnesses told us that there are 10,000 
chips on a North Sea oil rig, some of them under the 
sea. The impression from what you have said is that 
the companies who own those oil rigs will be 
responsible for that and, presumably, Railtrack will 
be responsible for checking out all their signalling 
systems? 

(Mr Cruickshank) Yes. 


59. Could you say a bit more about embedded 
chips, particularly in the Health Service where there 
are life support machines which have these devices 
in them? 

(Mr Cruickshank) I was beginning to translate my 
answer to Mrs Spelman into an observation on 
embedded systems. That is a focus of the Health & 
Safety Executive report which, it is indicated, will be 
published the week beginning 8 December. I have not 
yet seen that. It has also been the focus of a very 
helpful report from the IEE, the Institute of 
Electrical Engineering. But you are absolutely right, 
when I asked for a briefing from the DTI and others 
involved here, to give me everything to read about 
this, there was a very small pile on embedded systems 
and a very large pile which was everything else. It 
strikes me that because of the relative lack of 
awareness of the functionality of these embedded 
systems, the age of some of them, it probably is at 
least as important an issue as the more obvious 
software problems in office or other systems. That is 
merely me appreciating that it is at least as large a 
problem and observing that there is as yet relatively 
little known about it. 


60. You have mentioned electricity generation; can 
I ask you about the nuclear industry? It takes a long 
time to close a nuclear power station. 

(Mr Cruickshank) That is an obvious area where I 
would expect the Government to want to audit, I 
think, the compliance of, in this case, one company 
and to run the rule over what contingency plans they 
have in the event of failures. I expect that to be 
certainly one area where contingency planning will 
be demanded of Government, even though the 
problem is in the private sector. 
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61. I think I understood the complementary role of 
Action 2000 and Task Force 2000, but the previous 
group of witnesses suggested the whole thing needed 
a fillip, some oomph in it, and suggested the Prime 
Minister might appear on prime time television to 
give it that, which implies that unless something as 
dramatic as that happens we are not going to be up 
to speed. What is your view about that as a tactic? 

(Mr Cruickshank) 1 do not believe that chief 
executives should need to be seeing the Prime 
Minister on television to get a full appreciation of this 
issue. However, that sort of thing would help and I 
have had one brief discussion with the Policy Unit at 
Number 10. What they will advise to be the Prime 
Minister’s, or indeed any other senior ministers’, role 
on this I do not yet know, but I took it upon myself 
to enquire of Number 10. 

Dr Gibson: I am very grateful. 


Mr Beard 


62. Action 2000 and Task Force 2000: what do you 
see as the difference in roles between these two 
organisations which are now operating? 

(Mr Cruickshank) Task Force 2000 has been in 
existence for some time. Its initial role was to 
stimulate awareness. The surveys available to us 
suggest that that has by and large been done. The 
surveys, however, also indicate that somehow that 
awareness has not necessarily been translated into 
practice particularly in small and medium sized 
companies. So it is likely that Action 2000 will find 
itself, as we move into 1998, devoting more and more 
of its energy to the contingency planning I have 
talked about, as we have been doing in the telecoms 
industry, and supporting small companies. That 
means moving on from awareness-raising to 
gathering-together, making available in a _ user 
friendly way, best practice and so on; dealing as best 
we can in the time available with some of the likely 
skill shortages, a role for Government there yet to be 
defined precisely but we already have a number of 
projects in hand there. It means generally, getting 
closer to the implementation without slipping over 
the edge of saying to business, “We know how you 
should do it”, because we do not and we are not 
resourced to do that. 


63. In that process of implementation, it seems 
likely a lot of small companies will not have the 
resources in-house to comply. 

(Mr Cruickshank) Yes. 


64. Is there likely to be a problem of resources 
available to those sort of organisations? 

(Mr Cruickshank) I think there is likely to be an 
exacerbated skills shortage and, because this is a 
problem which has to be fixed by a fixed date, the 
longer the companies delay then the less available 
people there are to solve the problem from the 
available workforce. That is part of the message 
which needs to go out to chief executives, “Do not 
delay, because even though it may turn out there is 
not much for you to do, you nyay find there is no one 
to do it for you if you delay too long.” So it is part of 
the message and it is part of the work of Action 2000 
with, I would hope, the Government supporting us 
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separate from the money to fund Action 2000. It is 
something we will have to get to grips with. As you 
will be aware, skills shortages are not something 
which can be dealt with in short order. Some argue 
they take generations. My relative experience is in the 
Health Service where it is very difficult to shift the 
skill base very quickly, so I am not too sure how 
much we can do. The crucial thing is to get through 
to chief executives that the longer they wait, the more 
likely they are to have to spend more or find the skills 
are not available, or to refer to these cowboys who 
they might find are all they have to rely on. 


65. If the skills are not there, does that mean they 
will have to be replaced and capital expenditure will 
be needed to conform? 

(Mr Cruickshank) That assumes the assessment, et 
cetera, et cetera, has been completed and that is time- 
consuming as well. 


66. What about even the small scale where 
individuals have mobile telephones or alarm systems 
in their homes, what is the remedy there? Is that a 
liability on the original manufacturer? What is the 
remedy for individuals, domestically, having these 
things? 

(Mr Cruickshank) Like in other walks of life, it will 
depend on the nature of the contract you entered into 
with your supplier. We touch on a subject which is 
outside my immediate brief from Government. My 
brief is ensure the business systems work and that the 
necessary contingency planning is in place. There are 
individual consumers—and the obvious example is 
those who use PCs at home—who are to some degree 
vulnerable in a form we know not. The issue as to 
how it is, if it is, appropriate for Government to raise 
awareness amongst all personal consumers and what 
if anything can be done to help them through this 
problem, even if it is going to be more demanding of 
their supplier, is a question I have not addressed, and 
have not been asked to address, yet. It may be an 
issue you, as a Committee, might wish to. take 
forward. 


67. By what date will the director be appointed to 
Action 2000 and the Advisory Board? 

(Mr Cruickshank) I have in hand the search for the 
director, because that will take some time. There are 
thoughts about an acting director moving to appoint 
some team leaders, even absent-director, so that the 
substance of Action 2000 can be in work as soon as 
possible. As always there is a tension between seeking 
the best person and the time it takes, and I have been 
through that before. My lesson from previous 
experiences like this is that the first thing you do 
when you wake up in the morning is to think about 
the people, not the problem but the people, “What do 
I do today to progress getting that team in place”, 
and that is what I have been doing over the last two 
weeks. 


Chairman 


68. Can you tell us what criteria you will use to 
judge the success of Action 2000? You will be looking 
at what other people are going to do and monitoring 
what other people are doing—Government, private 
sector, small businesses, large businesses—but with 
your experience as a regulator and in industry you 
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will presumably want to put some benchmarks on 
your own activities. What criteria will you use to 
judge the success of your organisation? 

(Mr Cruickshank) I do not know yet. There is a 
very obvious one, which is that the lights do not go 
out. We are talking to research support companies 
who will help us in research to do that benchmarking. 
That will give me a much better understanding than 
is available to me now, notwithstanding this pile of 
briefing I have, as to the state of preparedness, 
particularly of big companies who are unwilling to 
talk publicly about it. This will give me more 
understanding of what are the factors which are 
stopping the chief executives of the small companies 
actually doing something about it. Do they not 
believe me? Do they think it will go away? Do they 
think suppliers will solve the problem for them? So 
from that research early in 1998 I will come up with 
some benchmarks against which we can progress 
Action 2000 on a regular basis. I would be happy to 
report back to you as to what my proper answer to 
that question is. ; 


69. You have given a proper answer; the proper 
answer is that you do not know and there is no point 
in saying you do when you do not. I think you have 
also conceded that some form of stage posts or 
benchmarks are going to be necessary. There is no 
point in finding out on Ist January 2001 you did not 
get anywhere; you want to know how you are getting 
on before then and you have agreed that. 

(Mr Cruickshank) That is in hand. 


Dr Jones 


70. How do you respond to the suggestion that the 
launch of Action 2000 has prejudiced the momentum 
for action arising from Task Force 2000? We have 
heard about the delays in getting your team together 
and so on. 

(Mr Cruickshank) I was very aware—in fact before 
I was appointed, as I discussed with Mrs Roche— 
that one of the key things I would have to achieve 
would be to maintain the momentum of not just Task 
Force 2000 but activities of industry associations or 
bodies which the DTI had initiated itself. So 
throughout the last 24 weeks or so my challenge to 
me has been to maintain the momentum I have found 
there. Actually I have a brief here of how we are 
doing that under about seven or eight headings—I 
will not go through it but I will flash it up just to say 
that maintaining momentum has been my second 
priority, my first one being the people. It is the sort 
of question which is almost impossible to answer, 
whether Action 2000 has or has not been a bar to 
progress. I doubt it. Certainly one of the first 
documents I received literally the day after I was 
appointed was from Task Force 2000 and a number 
of those who had been associated with the DTI and 
with trade associations in this area, spelling out in 
four or five crisp pages what they thought the 
priorities were and things which needed to be done. I 
took the view it was not for me to spend two months 
reviewing whether they were right or wrong but to 
take a very quick judgment as to whether we should, 
and how we should, pursue what was set out in these 
four or five pages. That is what we have been doing, 
working through—because I am not absolutely 
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resourceless—colleagues at the DTI who are acting 
as a stand-in project team for me. Since I am called 
Action 2000 I have come prepared with a list of 
things I have done in the last two weeks which I am 
happy to share with you. 


71. Perhaps you would like to do that. 
(Mr Cruickshank) Now? 


72. Why not? 

(Mr Cruickshank) We have talked about research 
and the point of research is for the purposes you have 
described but also, frankly, to inform the team. Some 
of the surveys which have been conducted have been 
in the form of the type where you send out X,000 
forms to fill in and you get 900 back and you do an 
analysis. Well, sorry, but that is not good enough. So 
we have to do something much better than that. So 
that is under way. 


73. What are you going to do which is much better 
than that? 

(Mr Cruickshank) There are better ways of doing 
research than sending out pieces of paper. 


74. What specifically are you going to do? 

(Mr Cruickshank) Three things. Firstly, a 
benchmarking study on the current state of 
preparedness particularly in large companies, just to 
get to grips with whether I am right that they are 
rather better prepared in some cases than they are 
announcing publicly. Secondly, the supply chain 
issue; how are these large companies using their 
supply chains; what are they demanding of the 
supply chains? Thirdly, research of a different type to 
understand what are the inhibitors to, particularly 
small companies, taking action, because unless we 
understand what the inhibitors are, we cannot direct 
our promotional activities and our information at 
them very effectively. We are going to appoint—my 
brief here says—“a top of the range media relations 
consultancy”, Iam not sure about that but anyway a 
media relations consultancy to take forward the sort 
of work that Task Force 2000 has been doing, which 
is about information dissemination and _ the 
preparation of a helpline, putting in helpline 
numbers and possibly a free phone, developing our 
own Website so it is easier for people, having been 
prompted by the awareness campaign, to do 
something about it. We have established groups to 
identify and classify all the readily-available advice 
and best practice and guidance, the sort of issues Mr 
Atkinson was talking about; and we have a plan to 
publish that on paper and in electronic form as soon 
as possible, and get views back from the industry as 
to what gaps need to be plugged. That is one of the 
key things there. We talked about assessment earlier, 
again in response to Mr Atkinson, and we are 
working on what type of scheme we could put in 
place to help smaller businesses in particular 
conform and to a recognised level. One may say, “I 
am conformed”, but what does that actually mean to 
those who wish to rely on it. People with skills, taking 
forward the initiative announced by Barbara Roche, 
and we have initiated eleven of the projects 
recommended by her team already. Moving to take a 
slice across all this, in the expectation that the main 
residual problem is going to be small and medium 
sized businesses, to set up a team to think about how 
to communicate more effectively with them, perhaps 
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and so on, and that is in hand. We have touched on 
embedded software but that is further back because 
of the lack of information available there. I talked 
about recruiting a director and we are beginning to 
have thoughts about the contingency planning in the 
private sector which might be required. 


75. Can I go back to the issue of skills? You have 
already identified that may be an issue. Let us assume 
you are successful in getting all these chief executives 
to face up to their responsibilities and give 
appropriate priority to this issue, how are we going 
to address the skills shortage? Exactly what is the 
nature of them and what are you going to do to 
address the shortage? It is not just in this country that 
we have got the millennium problem, it is an 
international issue, so it is an international shortage. 
What effect, for example, is the launch of the euro 
round about the same time going to have on the skill 
shortage because there is going to be a requirement 
for IT skills in relation to that too. 

(Mr Cruickshank) There is indeed, of a scale I 
understand which may be greater than this problem 
from my initial findings. As I said before, I think this 
is a very difficult area. It is not in the Government’s 
gift to change the skill base of the country very easily 
and very quickly, and that is where I will be spending 
most of my time. That will be my expectation. 


76. ICL apparently are enlisting retired computer 
programmers and looking at women who are taking 
maternity leave. This is obviously a serious problem 
and we are not going to be successful by the year 2000 
if we have not found these skills. 

(Mr Cruickshank) Yes, some of this is about the 
operation of the labour market. As the price goes up, 
I am sure there will be individuals who decide it is 
worthwhile going back to work for a few years for 
very large sums of money on offer. So part of it is 
going to happen because the price of these skills is 
going to rise, particularly if companies delay. That 
does not need me or the Government to do anything, 
that will happen automatically. The more difficult 
issue is whether the Government can take any action 
to increase the skill base beyond a simple operation 
of the labour market, and I honestly do not know yet 
just what that might add up to. 


77. What impact do you think all this is going to 
have on the future competitiveness of the UK? 

(Mr Cruickshank) It is going to mean a substantial 
diversion of scarce skills, IT skills, to solving a 
mundane but very important problem, and taking IT 
specialists away from new product development, 
service development, building systems to improve 
productivity for their own organisations and so on. 
The problem is shared around the world—to what 
degree we do not understand properly—so it is 
unlikely to have a major relative effect but there is 
bound to be a dampening effect on the innovation 
and initiative that UK industry is able to deliver in 
the next few years. 


_ 78. Finally, could I ask if “fo think there are any 
risks associated with people with insufficient skills 
working on critical systems? 
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(Mr Cruickshank) Yes. When we come to what sort 
of questions should the chief executive be asking the 
IT manager, that is one of the things we want to 
point out. 


Dr Turner 


79. You have already touched on it and obviously 
our economy does not operate in isolation from the 
rest of the world. How ready are we for the 
millennium compared with others, do you think? 

(Mr Cruickshank) I do not know. To the extent 
that one can rely on Government statements and 
Government initiatives, | would suggest we are at 
least as well prepared as others. As to the depth and 
the pace of the effort which is going on in the different 
economies, I have seen nothing in the briefing I have 
which would enable me to answer that question with 
any authority at all. 


80. Do you think there is a risk that we could 
import other people’s Year 2000 problems even if we 
were prepared? 

(Mr Cruickshank) Yes, and telecoms is an example 
of an industry where that could happen. But telecoms 
is also an example of an industry where the problem 
is potentially so severe that if it is identified early the 
resources are there because it is large companies—BT 
for instance is the largest employer of the relevant 
skills in the country. So there is a sort of inverse 
problem. The bigger the problem, the more aware the 
company, the earlier it is started, the more likely it is 
to be compliant. It is the smaller companies who do 
not realise the scale of the problem for their bit of the 
supply chain who are going to have the relatively 
large problems. 


81. Do you think there is an export opportunity for 
us here, at least in some areas, if our own companies 
are abreast of the problem? Is there an opportunity 
to export the expertise to other countries? 

(Mr Cruickshank) The communications industry, 
the IT industry, is an industry sector where the UK 
can claim to be or close to worldclass. We do not 
have many of them but it is one of them. So therefore 
there probably is, but again that is a general 
observation and it is not based on any precise 
knowledge. 


82. Is that something you are seeking to promote? 

(Mr Cruickshank) 1 think there is a limit in the 
timescale available to what I and a small project team 
can do. Again, I think that is up to the chief 
executives, in this case the chief executives of the 
companies who have the skills and expertise and the 
tools. I think I will leave it to them. 


Mr Atkinson 


83. Clearly the importance to Europe and the 
world, especially to Britain, of uninterrupted trade 
arises here. Are you concerned that the European 
Commission has not issued any guidelines on this 
issue or appeared to show any interest in this issue, 
and nor has it been raised at the World Trade 
Organisation? 

(Mr Cruickshank) Yes, and therefore I have been 
very supportive of, first of all, Mrs Roche’s intention 
to raise it at the Telecoms Council the week after 
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next, and we will encourage the Government to 
particularly use its presidency of the Union next year 
to give the issue not just more visibility but perhaps 
some action behind it. How the World Trade 
Organisation operates is a bit of a mystery to me, I 
am sorry. 

Mr Atkinson: Thank you. 
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task you are undertaking. We shall follow your work 
with great interest. If from time to time you might 
think it appropriate to drop us a note on anything 
interesting you are doing or have found out, we 
would certainly appreciate that. Again on behalf of 
all the Committee may I thank you for your 
assistance in the inquiry we are now undertaking. 


Chairman: Mr Cruickshank, thank you very much 
indeed, you have given us 45 minutes of helpful 
dialogue. We wish you every success in the gigantic 


Supplementary Memorandum submitted by Action 2000 


INTRODUCTION 


1. Action 2000 was launched by the Government on 28 October to help private sector businesses tackle 
the impact of the Year 2000 on their computer and other business systems. 


SUMMARY 


2. Since its launch Action 2000 has worked simultaneously both to set itself up in an appropriate form, 
and to develop urgently a campaign to help businesses take action. Action 2000 launched its Millennium Bug 
campaign on 22 January. 


3. This memorandum supplements that supplied to the Committee on 14 November and deals with the 
issues set out in the letter of 27 January. 


DETAIL 


(1) What is the current state of maturity of Action 2000? 


4. Action 2000 is now fully operational. It has a full-time staff of six, managed by its Acting Director Dr 
Ian Eddison. Its staff includes two secondees provided by IBM and ICL. The team 1s also supported by four 
DTI staff and external contractors. I am in the closing stages of a competitive recruitment process for the 
permanent Director’s post, three full time leaders and an office manager. Action 2000’s strength is 
supplemented by close relationships with Year 2000 experts throughout the IT community who are 
contributing in detail to its work. 


5. Iam considering the composition of my Advisory Board. I have sought advice from the key industry 
organisations and from major companies with direct experience of tackling the Year 2000 problem. 


6. Beside the Millennium Bug Campaign, launched on 22 January, Action 2000’s work plan already 
includes some six projects designed to provide information or detailed guidance on different aspects of the 
Year 2000 problem. Many of these are covered in the answers to questions below. 


(ii) Do younow have your own estimate of the scale of the Year 2000 problem and the state of the UK’s readiness 
to handle it? How does this compare to other countries? 


7. Action 2000 has collated a number of different surveys of national and international preparedness. 
Detailed results and sample sizes differ, but the key messages are reasonably consistent. 


8. The UK’s Year 2000 awareness activities now compare well with those in other countries. So far as I 
am aware the US, Australia, Canada, the Netherlands, Belgium, Denmark and Sweden are also undertaking 
broadly comparable programmes aimed at their own business communities. The UK, as the current President 
of the European Council, together with the European Commission, is urging other Member States to take 
suitable action to ensure their own preparedness at a national level. The issue is on the agenda for the 26 
February Telecommunications Council. 
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(iii) In your evidence you expressed the view that large companies were better prepared than they admitted. Do 
you think this is still the case? 


9. Yes, Since my appointment I have discussed this issue with senior figures in large companies in the UK, 
with trade associations, regulators, auditors and institutions such as the CBI. Action 2000 is now working to 
encourage as many of these companies as possible to share their experience to assist those companies whose 
preparations are less advanced. I was pleased that companies including Coca Cola, Unilever, BP, British Steel 
and Safeway supported the Millennium Bug campaign launch. Many of these companies are now turning 
their attention to helping smaller companies in their own supply chains to reduce the impact of the Year 2000 
problem. Action 2000 will be building on this. 


(iv) How severe is the problem for the smaller companies. How might they best be helped? 


10. The latest evidence collected by Action 2000 suggests that awareness of the problem among smaller 
companies is high, at over 80 per cent. However surveys have generally found that smaller companies are 
much less advanced in their preparations. Likely reasons for this include: 


— a lack of understanding of the issues and their business implications; 


— a feeling that small companies will not be seriously affected because of the small scale of their 
business; 


— uncertainty about how to start (eg how to conduct an audit of the problem) or whose advice to trust; 
— a feeling that there is still enough time to take remedial action on a small system; 

— waiting for large companies and suppliers to resolve the issue; 

— _ the cost of compliance may be relatively large in relation to the size of the business; and 


— lack of information on the Year 2000 in relation to embedded systems. 


11. Action 2000’s Millennium Bug campaign aims to address these by providing a package of information 
and signposting to support smaller companies through a seven step action plan (Understand—Prioritise— 
Assess—Plan—Implement—Test—Install). All enterprises are strongly recommended to keep an audit trail 
of their activity. This will be supplemented by further material covering, in particular, information on tackling 
embedded systems and on meeting the skills requirements of the task (see question (v) below). 


(iv) What is your view on the severity of the skills shortage and how best might it be overcome? 


12. The demand for specialist Year 2000 programmers and project managers able to service larger projects 
is high and increasing further, fuelling corresponding salary increases. Companies who need these specialist 
skills who have not yet recruited are likely to encounter problems unless they can match the increasing rate 
for the job. 


13. However in many cases smaller firms may be able to meet their own needs by undertaking modest 
retraining of their own staff, or making use of personnel returning to the IT sector who have updated their 
skills. Action 2000 is working closely with DTI and the Department for Education and Employment to ensure 
the skills training is provided by local Training and Enterprise Councils to meet local needs. We are also 
developing a complementary programme, in conjunction with Business Link network, through which local 
companies will be able to assess exactly what their skills and training needs are. We are already aware of a 
number of successful local programmes, for instance to recruit people capable of carrying an initial systems 
audit, or to update the skills of those returning to the IT sector after a career break. These initiatives should 
yield concrete results in the very short term. 


(vi) What concerns do you have about the readiness of critical national infrastructure services? 


14. This is probably Government’s biggest challenge—a public confidence in public services. Action 2000 
has developed a project plan for contingency planning spanning the private and public sectors. We will be 
consulting over 100 organisajions, including utility regulators, at a workshop on 24th March. The aim is to 
develop the project plan, agtee the way forward, and allocate responsibilities. I would expect this initiative 
to tie into the wider Government-plan as developed by the Ministerial Group announced on 27 November 
last year to oversee work being done in both the public and private sector. 


THE SCIENCE AND TECHNOLOGY COMMITTEE 23 


19 November 1997] [ Continued 


(vii) What programme of activities has been agreed by Action 2000 and what timetable has been set? 


15. The core of our programme will be the regular improvement and broadening of the advice and support 
given to SMEs. This will take the form of monthly updates to “The Millennium Bug Campaign” fact sheets 
and Website. A further key plank to this small company support will be the help being planned by local 
support organisations such as the Business Links and their equivalents in Scotland, Wales and Northern 
Ireland. These activities are being complemented by the setting up of BugNET, a national network of self 
help groups and the offering of a software diagnostic tool Comply2K through the National Computer Centre. 


16. Other key projects for SMEs under development or in the early implementation phase are: 


— A skills initiative to signpost opportunities and encourage training of new and returning staff. This 
is being run with the help and co-operation of DfEE. 


— A national PC campaign. 


— A large company/supply chain initiative catalysing the support that larger companies can provide 
for the SMEs in their sectors or client networks. 


— A marketing campaign aimed at improving the understanding of the problem and encouraging the 
SME base into action. 


— A continuous research and assessment programme aimed at monitoring UK industry’s state of 
preparedness and the inhibitors and drivers for action. 


17. Contingency planning as set out above. 


18. Investigation of the problems likely to be faced by consumers and householders, with a view to further 
public information programmes. 


19. Prompting Government to use its existing programmes (votes) and powers in a more targeted way. 
Examples are in relation to Business Links (see above), TEC training programmes and encouraging 
companies to disclose their preparedness. I view this as an important aspect of my role as Chairman of 
Action 2000. 


20. Supporting the Government in its effort to raise the international profile of this issue. 


21. I have consulted the Department of Trade and Industry and the Cabinet Office in preparing this 
Memorandum. 


27 February 1998 
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Memorandum submitted by the Confederation of British Industry 


INTRODUCTION 


1. The CBI welcomes the Committee’s inquiry as a further opportunity to stimulate action on the 
millennium date change issue. Due to the scarcity of time in advance of the millennium we encourage the 
Committee to reach and promote its conclusions with urgency; to this end we will endeavour to help as much 
as we can. 


2. The CBlis very concerned by the pervasive nature of this issue and its potentially damaging effect on the 
viability of every business. However, the impact is wider than the single business: it could affect the integrity of 
entire business chains. We are keen to promote action both by individual companies and by companies 
working together to minimise the effect the date change will have on our members and across the UK as a 
whole. 


3. We believe that though awareness of the issue is high, not enough organisations have taken sufficient 
action. Valuable work is progressing, including that through Action2000. We encourage the development of 
such work in order to support more companies progressing towards compliance. Growth in the number of 
companies undertaking compliance projects should be monitored and focus provided where necessary. 


4. This memorandum was produced in consultation with a cross-section of CBI member companies. 


ESTIMATE OF THE SERIOUSNESS OF THE MILLENNIUM BUG 


5. The millennium date change could adversely affect any system, product or process which features a date 
reference. Such a reference could be found in equipment as various as main frame computers, process control 
systems, PCs, video recorders, medical monitoring systems or any embedded chip. Software programmes, 
networks and in-company and national infrastructures may be affected. 


6. The date change could result in failure to meet the requirements of particular applications but the overall 
effect on all systems is difficult to predict. The effect and the cost of failure will vary on a case by case basis. 
It it therefore impossible for us to predict the precise impact of the issue until all organisations have conducted 
an audit of their systems and ability to handle the date change. It is difficult to concur with or refute the 
various published cost estimates of £400 billion world-wide or £30 billion for the UK. Irrespective of cost, 
the date change could have a real impact on all businesses and across borders. Business critical systems that 
would be adversely affected must be amended soon. 


EXTENT THAT ENOUGH HAS BEEN DONE TO AVERT POTENTIAL PROBLEMS 


7. A survey conducted by the CBI in October 1997 revealed that 85 per cent of responding CBI member 
companies had evaluated the impact of the date change on their systems and processes and that 80 per cent 
of those surveyed had agreed an action plan to deal with the problems. These results support evidence from 
other sources! that awareness of the date change, though not complete, has increased dramatically over the 
past year. The work of Taskforce 2000 and its associated bodies, including the CBI, has done much to 
facilitate this increase in awareness. 


8. However, as was illustrated in the DTI/Sage Survey,’ the lack of real understanding of the seriousness 
of the issues has been manifest by the failure of too many organisations to turn plans into action and start 
the process of correcting Ass systems. It is for this reason that the CBI supports Action2000 as the 





'Defusing the Millennium Bomb, February 1997—a survey conducted by PA Consulting and Taskforce 2000 
“DTVWSage study for Taskforce 2000 on small businesses and the Year2000 issue 
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appropriate body to bridge the gap between awareness and action. Action2000 can consolidate and build on 
the abundance of help and advice which has been developed within the IT and business communities and 
ensure that it is distributed to all enterprises in the UK. 


9. Given the difficulty that many organisations encounter in finding and assessing the value of the help that 
is available, Action2000 should provide a mechanism to enable quick and simplified access to information, 
including a method for assessing applicability. We have encouraged Action2000 to deploy the resources 
needed to capitalise on and publicise the help available in the shortest time possible. 


10. There are companies in CBI membership which have progressed millennium compliance projects to 
the stage of testing; there are others yet to start conversion. Over the past 17 months the CBI has promoted 
awareness and understanding of the millennium date change issue at the most senior levels as well as at 
functional levels: 


— Sir Colin Marshall, President of the CBI, raised the date change issue in his opening address to the 
CBI National Conference in 1997. 


— Adair Turner, CBI Director General, has given keynote addresses to business leaders, calling on 
organisations to take action. 


— Significant changes in national strategy have been communicated in the weekly fax from Adair 
Turner to the CEO of all CBI member companies. 


— The CBI’s most influential members have been directly addressed via the CBI Council, SME 
Council, Trade Association Council and all Regional Councils. 


— We produced and distributed 40,000 copies of a related briefing paper’. 


— _ The date change issue has been and continues to be regularly featured in CBI News, which has a 
monthly readership of 75,000. 


— Early in 1997 the CBI ran a series of regional workshops, through which the issues of designing a 
compliance programme, assessing the help available and making low risk decisions were presented 
to audiences of management and IT professionals. 


— The CBI has written many articles and features for publications both internal and external and has 
regularly responded to press interest. 


— In September 1997 the CBI stimulated and hosted a meeting of active bodies, the outcome from 
which was formative in the structure of Action2000. 


— The CBI hosted an Action2000/UK Year2000 Interest Group stand in the exhibition area of the 
CBI National Conference 1997. 


— Anew briefing paper, containing industrial and commercial case-studies, is currently being drafted. 


11. The CBI has made every effort to stimulate member companies to take action and will continue to 
support and work with Action2000, with the goal of encouraging the achievement of compliance for all 
business critical systems. 


HAS THE GOVERNMENT DONE ENOUGH? 


12. Establishing Taskforce 2000 and encouraging the participation of its constituent bodies was a positive 
and effective action by the Government to raise awareness of issues associated with the date change. We were 
keen for encouragement of action to follow this and therefore welcomed the establishment of Action2000. 


13. A number of organisations have emerged as exemplars of best practice in tackling the date change 
issue. Some have made public statements of the financial and personnel costs of achieving compliance but 
many, constrained perhaps by fear of the effect on the individuals involved as well as on the value of their 
company’s shares, have been reluctant to do so. 


14. A similar problem is faced by the developers of hardware and software, from whom it would be useful 
for the business community to elicit statements of compliance of current versions and of the dates and 
compliance of future versions. 


15. The Government is in a unique and powerful position. There are departments within Government 
which are progressing millennium projects. The intelligence amassed could be of value to non-government 
organisations, especially those within related business chains and would provide a huge contribution towards 
the strengthening tide of action. 


16. The Government and its departments have powerful communication mechanisms, which if applied to 
this issue, could complement the PR strategy of Action2000. Related Government schemes, such as the ISI, 
could also have a valuable role in stimulating action. 


3CBI Information Technology Brief, May 1997 Date change 2000: update 
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17. Millennium date change projects are expensive and many organisations have been forced to divert 
resources in order to tackle the issue. The Government has made a statement on how its departments and 
agencies plan to tackle the date change. We trust there will be careful consideration of budget allocation on 
the basis of this statement. 


18. Tackling the millennium date change does consume significant resource, which is particularly worrying 
for smaller companies and in sectors where resources are scarce. Action2000 has the power to provide tools 
that will help to make effective action by companies of all kinds simpler and more efficient. There is a valuable 
communication role for bodies and organisations such as trade associations, professional organisations and 
companies with strong positions in their supply chain, who have influence in their communities. In addition, 
hardware and software manufacturers can be encouraged to communicate advice and guidance to SMEs 
through their distribution channels more effectively than they have done so far. 


19. Already Action2000 has provided the stimulus for bodies that are active in the field to develop a 
common approach to collecting and distributing information. Given the lead by Action2000, business chains 
and the different sectors of industry and commerce can communicate awareness and the need for action to 
all their suppliers and customers. This can be reinforced by action aimed at smaller firms on a local basis 
through TECs, Chambers of Commerce, Business Links and their equivalents in Scotland and Wales. 


20. We would like to see a systematic approach to the assessment of the degre of system compliance across 
the UK. This could start with the key players across industry and be expanded progressively to build up a 
sector by sector picture of the state of UK readiness for the millennium. The assessment process could provide 
further stimulation for action as well as tracking progress and identifying areas where intervention is needed. 


21. The financial burden for compliance achievement has already proved arduous for some organisations. 
The CBI believes that companies are more likely to be supported by the financial community if they have date 
change achievement plans in place. ; 


MAJOR CONSTRAINTS MILITATING AGAINST PROGRESS 


22. The CBI believes there are a number of reasons why sufficient progress has not been made, which all 
stem from a lack of understanding of the nature of the potential problem: 


— some companies have failed to understand the potential impact of the problem on the future 
viability of their businesses; 


— many medium and large companies with relatively complex systems do not appreciate that time is 
short and that action is needed now; 


— some senior managers have not yet assigned the responsibility and authority to undertake a proper 
impact study or have failed to commit sufficient resources; 


— some companies have failed to identify the source of funds to tackle the issue; 


— some companies have problems in selecting the appropriate solutions for their businesses, due to 
the complexity of the issue and the plethora of advice available; 


— there is a dearth of role models and case studies; some companies have not been open in 
communicating their situation; 


— some companies lack the trained staff who understand and can manage the resolution of the 
issue; and 

— _ both within companies and across industry there is a lack of skilled specialists able to tackle the 
embedded chip issue; this problem has received relatively little attention and special focus could be 
required. 


| 


CONCLUDING REMARKS 


23. The millennium date change has already had a significant inmpact on resources. In the worse case 
scenario, it could have a drastic effect across the whole of the UK. The CBI commends Action2000, a neutral 
body consolidating community action, as a valuable vehicle for promoting action. Given the progress in 
addressing this issue thus far and provided momentum is maintained over the coming months, the UK could 
be in a competitively advantageous position. We expect that later surveys will show that large portions of 
industry are contributing to this goal by achieving compliance of their systems but until such a time as all 
critical systems are compliant, we will continue to encourage action. 


3 December 1997 
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Examination of Witnesses 


Mr ANTHONY ParisH, Director General, Federation of the Electronics Industry, MR KEITH JACKSON, 2000 
Programme Director, Yorkshire Electricity and Ms SARAH BALES, Senior Policy Adviser, Technology 
Group, Confederation of British Industry, were examined. 


Chairman 


84. Order, order. Mr Parish, on behalf of the 
Committee I would like to welcome you here this 
afternoon. Thank you, and your colleagues, for 
finding the time to be with us and the help that I know 
you are going to give us on our inquiry into the 
millennium compliance problem. Before I ask you 
the first question, would you care to introduce 
yourself and perhaps the two colleagues you have 
brought with you? 

(Mr Parish) Thank you very much, Dr Clark. lam 
Anthony Parish. I am Director General of the 
Federation of the Electronics Industry. I am a 
member of the CBI Council and I am also part of the 
Taskforce 2000 Steering Committee. As Director 
‘General of the FEI, it is a trade association which 
represents the IT, telecommunications, electronic 
components and defence electronics industry, so that 
is my background. On my left is Sarah Bales who is 
a Senior Policy Adviser at the CBI and is also a 
member of the Taskforce 2000 Steering Group. On 
my right is Mr Keith Jackson who is the Year 2000 
Programme Director from Yorkshire Electricity. 


85. Thank you very much indeed. We shall as a 
general rule, Mr Parish, direct our questions to you, 
but if you think it is more appropriate for them to be 
passed to one of your two colleagues, we will leave 
that for you to do? 

(Mr Parish) Thank you. 


86. I would like to first of all ask you whether you 
think the devotion and attention that has been paid 
to this millennium problem by a large number of 
companies who will be members of your CBI 
organisation is diverting investment from other IT 
projects; or would it be fair to say, as an alternative, 
that the effort that has been put into the millennium 
compliance problem is part of a general update of IT 
technology and programmes? 

(Mr Parish) \ think if I could give a general answer 
to the question and then perhaps ask Mr Jackson to 
give some specific examples from his own industry? 
There are clearly certain industries to whom 
information technology is absolutely vital. If you are 
running an insurance company the product is the 
computer programme and if you do not have the 
computer programme you do not have the product 
and therefore your capacity to generate new 
computer software actually determines the rate at 
which you can introduce new products into the 
market place. Therefore in a lot of industries which 
are very highly dependent on IT in that way and need 
to introduce lots of new products with high IT, the 
fact that we have this and things like EMU coming 
along is likely to deter them from introducing new 
offerings and maintaining their competitiveness. So 
as a general statement I would say that was obviously 
the case. 


87. Of my two options, it is probably the former? 
(Mr Parish) It would tend to be the former as I 
see it. 


88. As diverting from new investment rather than 
incorporating this problem into investment that has 
been planned, it is the former is it not? 

(Mr Parish) That is my impression, yes. 


89. Mr Jackson? 

(Mr Jackson) Obviously my experience will be 
focussed on a particular organisation, but I believe it 
to be generally correct for the utilities sector and I 
guess the answer is a bit of both. On the IT side 
certainly there is a timing issue that certain 
investment decisions that I think would have been 
made anyway are being brought forward to make the 
systems which would otherwise have been replaced 
perhaps early in the next century, be replaced to 
make them conformant. Clearly though there are 
certain activities, such as the inventory process, 
certain repairs to systems which would otherwise be 
shelved but which cannot be replaced within the time 
frame, and indeed the whole imbedded issue, where 
work is going on which would not otherwise be going 
on, clearly does represent a diversion of resource. 


90. Thank you very much. Mr Parish, in your 
submission to us you refer to the pervasive nature of 
this whole problem and it is a fact that affects the 
integrity of entire business chains. What do you 
judge to be some of the most critical business chains 
that are affected? 

(Mr Parish) Clearly, I think we have to start with 
the ones on which the infrastructure systems of our 
society depend, such as the supply of electricity, 
water, gas, the life giving substances, food. Those are 
the most critical ones obviously and failures in a 
major system which is then dependent on the supply 
of a critical component from somewhere else down 
the track which may not be available, clearly could 
represent a hazard if the chain is not managed. 


91. At the present time there is a lot of talk, 
particularly at the time of Kyoto, of climate change 
and so on and yet some people will say that there is 
no evidence of global warming at all; there is no 
evidence of the greenhouse effect. It is just a big 
nightmare that we are being obsessed with. Do you 
think that there is any possibility that this millennium 
compliance problem is just a big nightmare we are 
becoming obsessed with and that in actual fact 
nothing may happen at all? 

(Mr Parish) I think perhaps I could answer that in 
two ways. One is to say that companies are spending 
a great deal of money on actually changing and 
testing code. People are writing new computer 
software to change things that did not work. So there 
is action and therefore there is a problem. Now 
whether we are going, in practice, to get there and fix 
it all and nothing goes wrong on the day is a different 
question. 


92. Because there is action it does not mean to say 
that there is a problem, does it? 
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(Mr Parish) 1 think there is no doubt at all that 
systems have been identified which if they were not 
changed would fail. So yes, there is a problem to 
resolve. 

Chairman: Thank you very much indeed. Mr 
Jones? 


Mr Jones 


93. I have just been reading a publication called 
Construction Computing. There are a lot of small- to 
medium-sized companies in the construction 
company and there is an item there, Year 2000: Time 
is Running Out where the author, Clive Seddon, 
says: “I do not have the same level of confidence in 
relation to small and medium sized enterprises in the 
construction sector dealing with this problem.” 
There is also an item by John Harris which says: “Be 
afraid, be very afraid. Your very existence is being 
threatened by a terrible menace lurking below the 
surface like the iceberg that sank the Titanic”. Is the 
Year 2000 problem as significant for SMEs, many of 
which do not have business critical systems, as it is for 
large corporations? 

(Mr Parish) Perhaps Ms Bales could answer this? 

(Ms Bales) I think it does depend on the business 
criticality of any system within any organisation, so 
for SMEs, like larger organisations, it does depend 
how computer systems and electronic devices are 
used in their business. So it can be, but in other 
situations it may not be critical to that organisation. 


94. Taskforce 2000 did stress the need to set 
priorities for the allocation of resources and efforts to 
solve the problem; do you think that Action 2000 
should make SMEs a priority? 

(Mr Parish) It tends to do that. I think that there 
has been a general recognition for some months now 
that we are moving from the awareness phase into the 
action phase and that in order to prompt action you 
actually have to deliver things that people can use. It 
has been quite frustrating I think for small businesses 
hearing about this problem over the last year or so 
and nobody being able to answer two questions: 
“How does it affect me, my little business, and what 
specifically do I do?” and we have not yet delivered 
that package to the small businesses very effectively 
and I think that is what Action 2000 is seeking to do; 
turn the general into the specific. 


Mr Beard 


95. When Mr Cruickshank from Action 2000 was 
here he said he thought that many companies were 
not saying what they were actually doing about 
adjusting to the millennium 2000 problem; they were 
not making it public. Why do you suppose that is the 
case, if it is the case, and would it not strengthen their 
company’s hand in relation to its customers if they 
did declare what they were doing and gained 
confidence for it? And if they are not doing it, what 
should be done to encourage them to do so? 

(Mr Parish) I speculate along with the other people 
about why this may be and I seem to arrive at the 
same conclusions as other people I have spoken to 
about why companies do not Speak out. I think in our 
evidence we indicated that there seem to be two 
concerns. One is a personal concern that directors of 
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companies have legal duties which they have to be 
seen to fulfil, or do their very best to mitigate 
potential damage to businesses which they run and 
there is a feeling that if they raise a problem which 
they are then claiming to solve and then do not solve 
that, they put themselves in jeopardy. The second 
problem is that, alas, there is great fear, I think, that 
they will be marked down by financial commentators 
and advisers in the City and that their shares on the 
Stock Exchange could lose value if they say: “We 
have got this horrendous thing; we are going to have 
to spend £300 million to fix it” or whatever it is. That 
is our impression; Ms Bales may have a different 
view. 

(Ms Bales) No, I agree with that. I think in 
addition I agree with you that it could be a good thing 
if organisations did make others aware of what they 
were doing, given the considerations that they need 
to make in terms of directors’ responsibilities and the 
value of their organisations. 

(Mr Parish) If I could perhaps add one further 
point to that. In recognising this difficulty, because 
we have spent a lot of time going to see the people we 
knew to be taking significant action and asking them 
to please speak out, and they would not. So what we 
are trying to do now to compensate that is to get large 
companies, particularly in the same industry, 
working together in groups in which they are 
prepared to share information and that does seem to 
work. I think Mr Jackson would have something to 
add, if that is all right with you? 

(Mr Jackson) Very definitely. As far as the utilities 
sector is concerned there has been a lot of close 
working by the Utilities Group within the United 
Kingdom Interest Group, certainly on this very 
point, to develop mutual confidence because of the 
supply chain issues which are pronounced within the 
utilities sector and general electricity industries 
specifically. But to look at specific areas, because 
some of the problems that we are addressing are 
fairly new, it is not simply replacing computer 
systems which perhaps has been done in the past. 
Looking at the embedded risk, this is a new type of 
problem and in that sense learning from each other, 
shortening the learning curve in terms of how do you 
actually physically go about testing embedded 
systems for example, is something we can all share 
together because everybody effectively is at the 
leading edge together. Clearly some organisations 
may see competitive advantage in terms of not 
sharing; within the utilities sector, which is my 
experience, quite the reverse is true. There is a strong 
mutual interest in sharing information. 


96. What more could be done to encourage people 
to be more open about their state of preparedness? 
Have you a view on it? 

(Mr Parish) People have talked about the 
possibility of an amnesty of some sort as regards the 
City or something, but the City does not work in that 
way. We have tried to believe that you can muzzle the 
City or control what people think or how they act 
and I do not think that is a practical thing to do. So 
we are going to push very strongly down this line of 
getting companies to speak to each other in their own 
sectors, starting at the very highest levels and on 
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downwards and not necessarily asking them to come 
out on public platforms because we think we have 
failed on that one. 


97. As the CBI, you did a survey last October of the 
state of people’s preparations. Did the survey 
indicate that there was any particular type of 
company or sector that was more prepared or less 
prepared than any other? Were there any particular 
characteristics that shone out from this survey? 

(Ms Bales) The survey was conducted prior to the 
CBI National Conference this year and it was a very 
general survey. There were two questions within it 
which related to the millennium date change. The 
response that the survey commanded was cross 
sector and there was no further evidence other than 
a response of either yes or no to the two questions 
that were on there. So we cannot offer any further 
information. 


98. You cannot see any characteristics of those 
who are not complying? 
(Ms Bales) Not on the basis of the survey. 


99. Not between bigger organisations or small and 
medium? 

(Ms Bales) There was no breakdown in that survey 
at all. 


100. How confident are you that this 80 percent 
that came out of the survey is a reasonable figure? 

(Ms Bales) The response rate to the survey was 30 
percent, which is a good response rate I think for any 
survey, but I think that figure probably does give an 
overly optimistic view as to the state of preparedness 
of many organisations. Aside from that, the survey 
only asked two questions. It could have perhaps 
asked a third question which would have been along 
the lines of: “How far along the implementation path 
of your plan are you? How has your plan changed 
since you first looked at it, compared with now when 
you have actually been in and had a look at your 
system?”, but that further question or questions were 
not asked. 


101. So what would be your judgment on the true 
state of things if this is a bit exaggerated? 

(Ms Bales) That they are worse than that survey 
result would indicate. 


102. To what extent? 

(Ms Bales) It is very difficult to say without looking 
at every single organisation both within CBI 
membership and across the country. Until every 
organisation has assessed its system and, within that, 
identified its business critical systems, it is very 
difficult to tell. 

The Committee suspended from 4.35 p.m. to 4.48 
p.m. for a division in the House. 

Chairman: Once again, Mr Parish, and your 
colleagues, I apologise for the delay. It is after all the 
House of Commons and J am sure you understand 
the funny ways we operate! May I now ask Mrs 
Spelman to put her question? 


Mrs Spelman 


103. I would like to ask you which companies you 
consider examples of best practice in solving the 
millennium bug problem and how do you define best 
practice in this area? 
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(Mr Parish) There are I suppose a number of 
names of companies which circulate in the 
community of people who deal with this issue who 
have a reputation for having it under control. I think 
the companies in the oil sector, particularly Shell, 
British Petroleum, are perceived as doing a 
particularly good job given the challenge they have, 
for instance, in the North Sea where there are 
potentially very hazardous problems they have to 
address. The oil sector has addressed it very 
professionally. The insurance sector, Guardian 
Royal Exchange and others, again are looking very 
good and we are I think, speaking for the Taskforce, 
very impressed with the activities of most of the 
companies in the utilities sector, namely water, 
electricity on the whole are very good and I would 
like to say, I think, a word for Railtrack and the work 
that is being done by the rail industry in general 
which looks impressive. It is perhaps for this reason 
that we have tended to focus by sector in trying to get 
them together so we can make an assessment and say: 
“This sector looks good because they are working 
together and seem to be doing sensible things, and in 
this sector they are doing less well”. And that is how 
we are trying to do it, because we cannot chase a 
million different companies easily. 


104. And your definition of best practice? 

(Mr Parish) I think perhaps I would defer to Mr 
Jackson on that matter? 

(Mr Jackson) I do not know if we could purport to 
be best practice, but hopefully it is certainly good 
practice. We took as a lead the guidance provided in 
the CCTA documentation which forms an approach 
to dealing with the issue which we certainly found 
very useful. Certain, and as I say, if I am talking here 
in a sense generically, colleagues elsewhere in the 
utilities sector that I have dealt with, things that seem 
to be making the programmes go well, I think first 
and fundamentally from a corporate point of view is 
board support because patently without clear 
executive support within an organisation frankly 
nothing will be delivered. It will not have the 
commitment, it will not have the resources devoted to 
it. Beyond that certain organisations, and again, this 
is a scale issue because in the utilities sector they tend 
to be large organisations, where we have largely 
dedicated resources. Our example within an 
organisation which has a group structure where there 
is a central team dealing with the issue with some IT 
expertise, some engineering expertise, access to legal 
expertise, to provide standards to support and 
control the process across the group as a whole. 
Indeed we do work, and again best practice seems to 
dictate that the process should be highly disciplined 
given not least I guess the litigation risk but probably 
primarily the time scale risks is the need to work ina 
thoroughly disciplined fashion. We have quite a 
comprehensive set of procedures to work to and a 
fairly tight set of plans and controls that we report 
upon to gauge progress against those standards and 
time scales. Other areas that again we look at 
particularly are communications, often one of the 
softer issues, but certainly in terms of communicating 
with our customers, with other suppliers and being 
up-front about what our organisation is doing about 
it, also communicating within the organisation 
because it is one of these issues that at some levels 
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appears to have very little in the way of business 
benefit. Clearly there is a need to focus people’s 
minds on what could go wrong and avoiding the 
negative and our job is to keep that in the forefront 
of people’s minds across the whole corporation. One 
other area, and it has been touched upon, is the whole 
supply chain issue, because—using electricity as an 
example—as a distributor and supplier of electricity 
at the end of the supply chain if the transmission 
system or the generation system is not working the 
end delivery system, in a sense, has nothing to deliver. 
So it is a classic supply chain issue there. 


Mr Atkinson 


105. Obviously I was a little miffed that the CBI 
should have opposed my Bill which I felt was a 
practical response to resolving this problem and 
indeed sought some credit in CBI defuses 
Millennium Bomb Bill in so doing and yet we heard 
from the head of Taskforce 2000, Robin Guenier, a 
couple of weeks back—as you know he probably has 
his grasp on this issue more than any other person in 
this country—he said the problem is more serious 
than the CBI realise, so it rather smacks of 
complacency. So the question I would like to put is 
why did the CBI oppose my Bill? secondly, did it 
consult amongst its members as to what their 
response might be to my Bill because when I 
consulted the top 100 companies I got majority 
support for my Bill? 

(Mr Parish) Luckily, I think I can ask an official 
from the CBI whether she could respond to the first 
point at least. 

(Ms Bales) The reason why the CBI opposed the 
Bill was because at the time we felt that the structure 
that was being proposed would not have been 
appropriate in terms of stimulating action, but also 
in terms of its interpretation by the organisations 
that it would affect, which would be every 
organisation in the country. The CBI has been in 
dialogue with many of its members over this issue 
over the last 18 or 19 months. In terms of an absolute 
consultation on whether we would or would not 
support the Bill, we did not enter into that and we do 
recognise that for some organisations it would be a 
mechanism by which they would be assured that 
some of the organisations with which they did 
business would be considering the millennium issue. 
However, for many organisations it would be 
something that would provide an onerous task upon 
themselves and would not take them any further 
along the path of achieving compliance or even 
assessing their systems. 


106. Okay. So you are supporting the Government 
that it is the voluntary approach which is the only 
approach on this issue and yet you say in CBI at 
Work and I quote: “Despite efforts to cajole, 
encourage, inform or frighten organisations and 
business chains into taking action, too many are still 
unprepared for this challenge”. You have been 
holding road shows amongst your members to draw 
attention. What kind of support have you been 
getting at those road shows? 

(Ms Bales) We held a seriés of road shows at the 
beginning of 1997. They were all deemed to be 
successful. They were all aimed at encouraging a size 
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of audience depending upon the location that they 
were held in. I think the audience ranged from 40 to 
50 and upwards towards the 100 mark which was 
what was being aimed at. I think the real message 
that came from those road shows was that, at that 
stage, awareness was building. In promoting the 
roadshows we mailed thousands of organisations 
both in CBI membership and outside and that the 
attendance at those roadshows was the level that it 
was was a by-product of this awareness raising 
activity. The road shows themselves proved useful to 
the organisations that attended and also useful in 
terms of looking at how we might focus any future 
work that the CBI has undertaken over the last year. 


107. But you did not raise this issue prominently at 
your last Conference? 

(Ms Bales) Sir Colin Marshall gave an opening 
address to CBI Conference in which he did talk about 
the millennium date change issue as one which every 
single organisation needs to address and to which 
every organisation needs to commit board level 
support. 


108. Thank you very much. My final question, Mr 
Chairman, is about the imbedded chip problem and 
may I quote from. Government Computing in 
October: “The more one reads about imbedded 
processes, the more one realises that it is there that 
the real millennium bomb exists. Nobody seems to 
have a clue as to how to investigate it, let alone how 
to fix it.” So can you give us the CBI’s view on this 
particular aspect, the imbedded chip issue, and can 
you confirm that there appears to be very little action 
on the problem compared to that of computer 
hardware and software and what the Government 
should be doing to redress that problem? 

(Mr Parish) That statement might have been true 
about May of this year, I would say. Since then there 
has been a dramatic move forward. We do recognise 
that we were relatively slow in addressing the 
embedded chip issue, partly I think we had tended to 
run somewhat behind the United States on this whole 
issue. In the United States IT is in the boardroom and 
in the United States they picked up on the whole 
Year 2000 IT problem very, very quickly because 
chief executives, CEOs in the United States have IT 
very much more to heart than is the case here. But 
they have done remarkably little on the embedded 
chip problem and so taking their lead as we did we 
tended to ignore it as well. In the last six months there 
has been a dramatic change, an enormous amount of 
effort from the IEE, which has become the focus of 
gathering together expertise. They have printed a 
huge book, they have a very big web site. We 
probably have 40 or 50 consultancy companies now 
working actively in this field when six months ago 
there were probably only three or four. If we look at 
the Year 2000 Interest Group which is a body of 
some 250 larger businesses who work together, and 
Yorkshire Electricity is part of that, their Embedded 
Systems Groups are incredibly dynamic and really 
very effective so that area is moving very fast. There 
are one or two problems. One is that it turns out that 
testing embedded systems is very, very difficult 
indeed. You cannot turn off an awful lot of things to 
test them. You cannot turn off a nuclear power 
station very easily; you turn it off, it is off fora month 
anda half. You cannot stop a blast furnace, and there 
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is not yet agreement as to how to test these things. So 
there are still significant technical issues in the way. 
But we are catching up very quickly and we are 
working not so much through the high profile of the 
press with this one because that I think we could not 
really follow the other major alarm, but we are doing 
it through the engineering industry very largely and 
it is beginning to work. I am very encouraged by the 
progress that has been made myself and my 
Association is very much involved with this with 
British Aerospace, GEC, British Telecom and so on. 


Dr Turner 


109. I have a slight personal interest in this because 
Iam not even sure whether my own office systems are 
compliant. Would you welcome legislation to compel 
suppliers to say whether the products they are selling 
are compliant? 

(Mr Parish) Not particularly, because I do not 
think that it is very easy to determine what 
compliance is. Funnily enough, we are just coming 
out with another definition of what is compliance 
and we have been working on these definitions for 
clients for 15 months because it turns out not only to 
be 31 December but there are tricks like 29 February 
in the year 2000 and have people worked out whether 
that is indeed a leap year or not? There are other 
dates that things can go wrong apart from 31 
December. I think there are about 15 different dates 
over and around the turn of the century when the 
thing might go wrong. So what is compliance? It is 
not entirely clear. It may be that there are a lot of 
things that are not compliant, but they have no 
negative effect and therefore do you mind about that 
very much. I have a PC whichis not compliant. I turn 
it off at midnight, I turn it on at one o’clock in the 
morning in the next century, re-set the time of day 
and the date and it will go and I have had no 
problems. It is not a compliant machine, but I have 
worked it by manual means over the end of the 
century. There are so many ways around the 
problem. 


110. There is in fact a British Standards Institute 
definition of compliance? 

(Mr Parish) Yes, we do not like it. We are 
changing it. 


111. Do you think suppliers should declare that? 

(Mr Parish) No, not that one. No. In fact suppliers 
are working on a different version of that and might 
be prepared to accept one that is different from the 
current British Standards one. The British Standards 
one certainly does not cope with embedded systems 
because they have different characteristics, so we are 
going to have to change it anyway. I think we may 
then be able to bring many suppliers to say they 
comply. The difficulty with that is that the big 
suppliers who will step up to this are probably the 
people who are going to comply anyway and the 
small suppliers who are causing the problems, people 
who are back street, put-togetherers of PCs, they are 
going to say they comply whether they do or not and 
the law is not going to make any difference to them. 


112. Trading standards would have something to 
say about that? 
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(Mr Parish) Yes, they would, but we have never 
felt with this issue that the law or appealing to the law 
or using the law is somehow something that is going 
to help the case forward. 


113. To what extent are your members actually 
putting pressure on the suppliers to make sure that 
the equipment they are getting from them will cope 
with the date change? 

(Mr Parish) A great deal. One of the things that 
does happen is that we get a group of suppliers in 
front of 20 or 30 users at a time. You get IBM or 
Microsoft or whoever it is up and we get serious users 
actually really digging into them and pushing them 
pretty hard and these major corporations have 
simply had to say: “Yes, well we are not actually 
quite compliant” and we are getting a lot more 
information by running these sort of vendor events 
and we are pushing the big suppliers very, very hard 
and actually sharpening up their performance quite a 
lot. That has been quite an encouraging way of 
working. 


114. You think it is galvanising them into action, 
do you? 

(Mr Parish) Oh yes, I think so. There is more to do 
in the embedded systems area however. We are well 
behind in that regard in that field and we have to 
work very quickly on that. 


Dr Gibson 


115. What would you like to see Action 2000 doing 
in the next two years in terms of the priorities, for 
example, remembering that Mr Cruickshank said to 
us that it was not his role to be active in solving the 
problem? What do you think they ought to be doing? 

(Mr Parish) Getting useful advice out to the 
community, which means making the best practice 
information which is around—and there is a lot of it 
because there are a great many organisations doing 
good things—getting it together and delivering it. 
Delivering it to and through the kind of groups that 
Yorkshire Electricity belong to so that it will help 
them to manage their problems through the supply 
chain. Getting it out through business links, getting 
it out through the dealers. One of the things we want 
to push is the agents of the computer companies to 
get them to put out good material, so it is really a 
question of gathering all the stuff together in one 
piece and then finding good vehicles for 
disseminating them. 


116. It is a pure education thing as you see it? 

(Mr Parish) Yes. Taskforce 2000 did a very good 
job saying: “Pay attention, this is a huge problem and 
unless you do something very, very immediately 
there is going to be a major disaster” and Robin 
Guernier to a certain extent is still saying that same 
thing. We think the time now is to say: “This is a 
really important issue. You have to get on with it and 
here are the tools to do the job” and that is the 
important change from Taskforce 2000 to Action 
2000. It is equipping companies. 
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117. Although, Mr Parish, as Dr Gibson said, Mr 
Cruickshank has said that it is not his role to be active 
in solving the problem. If it were as neat as you have 
described that Taskforce 2000 was an organisation 
that made people aware of the problem, then Action 
2000 is an organisation that came in to help to solve 
it, that would be very neat and very laudable. But it 
seems that Action 2000 does not see itself as the 
organisation to help solve the problem either? It is 
another awareness organisation? 

(Mr Parish) 1 am quite surprised at that reaction 
because over the last three months we have been 
holding regular meetings of the 15 or 20 or so people 
most involved in providing central help: The British 
Computer Society, the major companies like British 
Telecom, my trade association, the CSSA and others, 
people who are trying to generate material and Don 
Cruickshank has been involved in the last three of 
these meetings and there we are, we have groups 
working on writing presentations to go to small 
businesses. We have people putting material on web 
sites to be available as toolsets. We have best practice 
groups writing best practice guidance material and 
gathering them together, all of those things are 
happening. My understanding is that Don 
Cruickshank intends to encourage all of those things. 


118. Let us put it down to semantics then and let us 
say that when Mr Cruickshank says he is not active in 
solving the problem, he may be active in propagating 
the way to solve the problem, but he himself may not 
be active in solving it and let us hope that is what is 
meant; but I am sure that we will all check when we 
leave this meeting to see if that is the case, certainly 
we shall? 

(Mr Parish) Yes. 


119. Time is running out. May I put the last 
question to you, Mr Parish? You will be aware of the 
fact that considerable IT resources are being devoted 
to making preparations for the single currency if and 
when it should happen. To what extent do you think 
those resources are hampering progress towards the 
millennium bug and which do you think is the most 
important at the present time, preparing for the 
single currency or preparing for the millennium bug? 

(Mr Parish) 1 think if I could answer the last 
question first. Clearly the single currency is 
potentially a moveable feast which the Year 2000 is 
not. You cannot buck the date! There are certain 
businesses, particularly within the financial sector, 
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where it is extremely complex to try and modify 
systems for the date and for the currency at the same 
time. It makes the testing of such systems once 
altered immensely complicated. Maybe if you have a 
factor of one for testing one of them, testing for when 
you have made both sets of changes it costs a factor 
of four more, so that seems to be a great complexity. 
Perhaps Mr Jackson would something about this 
from his perspective although he is not in the City. 


120. If you could be brief, Mr Jackson, because we 
are holding the Minister up at the moment, but we 
would like to hear your answer? 

(Mr Jackson) We are perhaps in the fortunate 
position of being largely domestic in terms of our 
customer base. As far as our major systems are 
concerned we are in the process of evaluating what 
needs to be done. We think there are manageable 
work-rounds, certainly for the 1999 scenario, and 
therefore that would not have an immediate impact 
on the 2000 solution. Other organisations who have 
a less domestic market may have greater problems. 


121. So the short answer is that the preparation for 
the single currency is having only a minimal effect 
on 2000? 

(Mr Jackson) Within our organisation, but I 
would stress that is based on not being an 
international organisation. Our customer base is 
largely Yorkshire and Humberside. 


122. So you are putting in a cautionary word there. 
It may be worse than that elsewhere? 

(Mr Jackson) Very definitely and the point in terms 
of complexity, if you are making major changes to 
systems of two different areas at the same time there 
is an exponential growth in terms of complexity for 
acceptance testing. 

Chairman: Thank you. Mr Parish, we have come 
to the end of our time. We would like to have gone 
on, but in fact in the time that we have had you and 
your colleagues have been most helpful to us. 
Bearing in mind we had to take 10 minutes off to do 
other business elsewhere, we have got through an 
enormous amount of questions and answers. A lot of 
information has come our way which has been 
recorded in a variety of ways. We thank you, we 
thank Ms Bales, we thank Mr Jackson and in due 
course, if we may, we will send you a copy of our 
report and thank you for the help you have given in 
compiling it. 


Memorandum submitted by Department of Trade and Industry 


SUMMARY 


1. My responsibility on the century date is to co-ordinate the Government’s interest in private sector 
systems, and this Memorandum is primarily devoted to that. 


2. This is a very serious problem which every organisation must address without delay. Those who have 
the problem in critical systents must plan now how to tackle it. The Government cannot fix the problem for 
businesses, but we will continue to urge them on. We are determined that the advice they need should be made 


available. 
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3. The Department and its Agencies are tackling their own systems and a copy of our Plan has been placed 
in the House of Commons Library. The Department is also responsible for ensuring that those public sector 
organisations which we sponsor, such as the Post Office, are tackling the problem. 


4. Like other Government Departments, the DTI has an interest in aspects of the problem which cross the 
public sector/private sector boundary. These common issues are amongst the problems which J expect to be 
considered by the new Ministerial Group which is to be chaired by the President of the Board of Trade. 


5. The Memorandum addresses the issues in your Terms of Reference in turn. The Department was 
consulted by Don Cruickshank in the preparation of his Memorandum and in general we endorse his 
comments on these issues. To avoid repetition, this Memorandum provides additional material. 


DETAIL 


(i) The nature, magnitude and implications of an inability to manage the date change in personal and mainframe 
computers, embedded systems and software, especially where such computers are performing safety critical 
operations. 


6. If this problem were ignored, the consequences would be very serious. Financial systems, utilities, 
manufacturing processes, transport, distribution, communications and services of all kinds depend 
increasingly on computers and other electronically controlled equipment. Fortunately, many organisations 
are already tackling the problem. The Government’s objective is to ensure that as many as possible of the 
critical systems on which we all depend are fixed in time. 


7. The IT industry has advised me that there is already a shortage of skilled people. As more businesses 
start to check their systems, and as others move from checking to fixing, these skill shortages will intensify. 
It is therefore necessary to do what we can in the time available to increase the skills pool. Action2000 is 
following up the discussions which started at the Millennium IT Skills Summit which I hosted in July. 


8. It will also be necessary for organisations to switch resources in the short term from other projects to 
work on the century date problem. Organisations will also need to prioritise, identifying the systems which 
are critical for business operations, for health and safety, or for the environment. 


9. This means that the problem is one for senior management to address. They must set priorities and 
allocate budgets. They must ensure that the IT and other technical experts are able to tackle the job with the 
urgency required. 


10. Itis dangerous, however, to prescribe general solutions across the full range of UK businesses. Some— 
like the banks—are highly dependent on IT, and in general we believe that they are already well advanced in 
tackling the problem. Others make little or no use of IT. In between is a range of businesses which are 
moderately dependent, have perhaps made a start at thinking about the issues, but have not all advanced very 
far. Our concern is that every business should make an assessment without delay of the scale of the problem 
in its critical systems and decide what, if anything, needs to be done. The bigger the task, the sooner the 
business should act. All businesses are likely to find that, as the year 2000 approaches, it will become more 
difficult to obtain external help. 


11. For many systems, which manipulate dates in the future—such as financial planning systems— 
malfunctions will occur before 2000. Nevertheless, I believe that for the vast majority of businesses there is 
still time to act if they start checking now. 


(ii) The effectiveness of action which has already been taken to avert problems in Government, large corporations 
and small businesses. 


12. Government systems lie outside the scope of my responsibilities. 


- 13. Most businesses are reluctant to discuss the extent of their problems or the action they are taking, 
although more information is becoming available from larger companies. More generally, survey evidence 
suggests that progress through the checking phase to the action phase is underway, though not as rapidly as 
we would like. 


14. One of the tasks of Action2000 will be to obtain much better and more systematic information about 
the current state of preparation and the plans which businesses have to complete the work in time. Action 
2000 is expected to get a picture of progress in all business sectors, and to look particularly closely at key 
sectors on which the economy at large depends, such as telecommunications, energy, financial services and 
others. 
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(iii) The role of Government in raising awareness of the potential problems and in seeking solutions and the 
respective roles of Taskforce 2000 and the recently launched Action2000. 


15. Businesses cannot evade the responsibility for tackling their own systems. 


16. The Government’s first role is to alert them to the issue and the need to tackle it urgently. The 
Department started work in this area under the previous Administration, and the present Government has 
continued to support these efforts to raise awareness. We have continued to provide funding to Taskforce 
2000, to work with the Taskforce on its programme of events and to consult.it about the issues. This funding 
will cease on 31 March 1998 or when the £350,000 to which we are committed has been spent, whichever is 
the sooner. 


17. We believe that awareness amongst the business community is now high. Businesses know there is a 
problem. The emphasis needs to shift from telling people that a problem exists to ensuring that they take 
appropriate action. This is the conclusion I came to on the basis of consultation by the Department during 
the summer with a range of organisations actively involved in the problem. 


18. We therefore decided to establish a new initiative, Action2000, to look at all aspects of the problem, 
to advise the Department on what needs to be done to stimulate action, and to orchestrate all the many 
organisations which can help businesses tackle it. In doing this, Action2000 will need to determine what is 
inhibiting some businesses, to take stock of the range of help already available, and to address any gaps. 


19. Details of Action2000’s task are set out in Don Cruickshank’s Memorandum dated 14 November 
1997. 


20. Don Cruickshank has been told that the budget for Action2000 would be up to £1 million per financial 
year (in each of the year 1997-98 to 1999-2000 inclusive). 


21. This budget is not of course a budget to fix industry’s problem. Industry must finance that. As with 
other business problems, the best prospect of solving it lies in the market place, where users recognise the need 
to commit their resources to it and thus provide commercial organisations with an incentive to help. Action 
2000’s role is to orchestrate a framework of support activities which will make the task easier. The budget 
has to be sufficient for that task. 


22. The Department has also sought to raise awareness internationally. A number of countries have 
followed the UK’s lead in taking the initiative with business, and I have raised the issue with my European 
colleagues on the Telecommunications Council of Ministers. 


(iv) The extent to which new systems and software are “millennium compliant”. 


23. The Department is not aware of any comprehensive information on this point. The Computing 
Services and Software Association has a database on some IT software. Action2000 will be considering what 
additional information can be provided, and will also be exploring what data is available about electronically- 
controlled equipment. 


24. Purchasers need to check whether their intended purchases are millennium compliant, and if not 
whether the non-compliance is insignificant or likely to be remedied by a subsequent upgrade. They should 
ask about the timing of the upgrade and whether any additional charge will be made. 


25. Millennium compliance is only one feature of a purchase, and provided purchasers are aware of the 
issue they should be able to take it into account in making their choice. The normal provisions of the law 
governing such purchases will provide further protection. 


26. Compliance of the system will depend upon the hardware, operating system, software and data all 
being compliant, and on the user using the system in the right way. 


(v) The development of contingency plans in the event of system and program failures. 


27. Just as responsibility for avoiding significant malfunction rests with the business concerned, so does 
responsibility for considering contingency planning in case significant malfunction does nevertheless occur. 
A business will need to consider malfunction in its own critical systems, but also any electronic links it may 
have with other organisations. Even where there is no electronic linkage, the business may be economically 
dependent on other major suppliers or customers and may need to plan for the possibility that they are 
seriously affected by malfunction. 


28. The extent of contingency planning undertaken should clearly depend on the size of the risks to which 
the business is exposed, the probability that they will materialise and the extent to which damage can be 
minimised more easily and heen by advance planning. These are issues which senior management needs 
to address as the size of the problem and the extent of preparedness becomes clearer in the coming months. 
We hope that better information will be forthcoming from Action2000 and other sources. 
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29. In some sectors of the economy, particularly where there is a high degree of interdependence between 
businesses, it may be desirable for industry to undertake contingency planning on a collective basis. 


30. The role for Government is to encourage and facilitate this planning by the private sector. It will also 
be necessary for Government Departments and other public sector organisations to undertake such planning 
in relation to their own systems. The new Ministerial Gorup will have oversight of this process. 


(vi) The legal implications of disputes over liability for compliance costs and system and program failures. 


31. Every user facing the need to fix or replace a system will need to consider whether the supplier or 
another contractor has any legal liability. The legal position will vary from case to case, and we see no need 
to amend the law. It is important, however, that the user should recognise that he has the ultimate 
responsibility for ensuring that critical systems on which the business depends are tackled in good time. He 


should not put the business at risk while arguing over who is to pay for this. 


32. This is a message which Action2000 may need to promulgate. 


33. We have consulted the Cabinet Office and Action2000 in preparing this Memorandum. 


8 December 1997 


Examination of Witnesses 


Mrs BARBARA ROCHE, a Member of the House, Parliamentary Under Secretary of State for Small Firms, 
Trade and Industry, and MR STEPHEN Pripg, Director, Supply Industries Sponsorship, Communications 
and Information Industries, Department of Trade and Industry, were examined. 


Chairman 


123. Welcome, Minister. Thank you very much for 
finding time in your very busy schedule to be with us 
this afternoon to help us in our inquiry into the 
computer compliance or the 2000 bug as it is called. 
We know you very well, but before we ask you our 
first question, would you be so kind as to introduce 
your companion this afternoon? 

(Mrs Roche) Yes, certainly, Dr Clark. My 
colleague is Mr Stephen Pride who is the senior civil 
service official in my Department assisting me with 
this matter. 


124. Thank you very much. Welcome, Mr Pride. 
Minister, could I first ask you about suggestions that 
have been made that as much as 29 percent of the 
United Kingdom’s GDP could be at risk if the worst 
fears of the millennium bug come to pass and how 
great do you judge this risk to be yourself on your 
Department? 

(Mrs Roche) Thank you very much, Dr Clark, and 
may I just say right from the beginning how pleased 
I am that this very important Select Committee is 
discussing this issue because as far as Iam concerned 
it is one of the very key issues facing our industry 
today. As far as the question of effect is concerned, I 
think it is probably very, very difficult to give a 
precise effect on its effect on GDP, because I think 
there will be very many issues that one would need to 
take into consideration. For example, what the scale 
will be of fixing the problem, the extent, also what 
other things would not get done because this has to 
be done and that may all be very difficult to calculate, 
but may I certainly say that as far as the Department 
is concerned and as far as Government is concerned 
and as far as our anxiety is concerned about business, 
we think that it is a very serious problem, a very 
complex problem and one that we are taking very 
seriously indeed. And certainly one that we believe 


that if business does not grasp the nettle and act very 
soon and very seriously it will have very adverse 
consequences indeed for this country. 


125. Do you think on the smaller scale, on the 
micro-scale perhaps, that some businesses could 
actually fail and become insolvent if they were very 
heavily dependent on computers and scheduling and 
they failed to take note of this problem? 

(Mrs Roche) We certainly would not discount that 
possibility at all, which is why we are taking the 
action we are taking now. What is very key for us is 
that business recognises its responsibility. This is very 
much a problem that has been created by industry 
and it is one that industry itself needs to tackle, but 
having said that we believe that there is some 
additionality which the Government can provide and 
that is assisting business to look at the tools that they 
will need to do something about it. I think we are in 
the situation at the moment where there is a high level 
of awareness, but what worries me, Dr Clark, very 
much indeed is that that awareness has not been 
translated into action and that is where I think that 
the Government can provide the necessary 
additionality. What I really want to see is a 
concentration by larger businesses on their supply 
chain relationships because of course what is very 
important for large businesses and medium sized 
businesses is not for them to say: “We are millennium 
compliant. We are all right”, but for them to think: 
“Well, hold on a moment. What about my 
customers? Are my customers compliant? Are my 
suppliers compliant”. If we are in the situation where 
that is not the case then there are very serious 
problems indeed. So what I think we are doing as far 
as the Government is concerned, why we formed 
Action 2000, is to encourage them to think of the 
picture in the round and of course apart from 
appealing to their own interests, their own 
enlightened interests, to look at the country as a 
whole. That is certainly what we will be 
concentrating our energies on. 


36 MINUTES OF EVIDENCE TAKEN BEFORE 


10 December 1997 ] 


[Chairman Cont] 

126. Just a small point before I pass over to Mr 
Beard, but having worked for some time in the motor 
industry I know, as you will know, that when you 
have a production line—and you have mentioned the 
supply chain—you only have to have a supplier of a 
very small component, that seems to be minuscule in 
the scale of things, who fails to deliver and the whole 
line comes to a halt and that is how the whole thing 
can escalate. So the point you are making to us is that 
the large companies who might in themselves have 
got things right have got to go down the line to make 
sure all their suppliers are right, otherwise they could 
come to a halt; the kingdom could come to a halt for 
the want of a horse shoe nail? 

(Mrs Roche) I could not agree with you more, Dr 
Clark. One of the interesting things I do as part of my 
portfolio anyway is visiting numbers of businesses 
and certainly when one visits—I mean, you talk 
about the car industry; the car industry is a very good 
example. That industry is reliant on its supply chain, 
very reliant on large numbers of small suppliers. 
Quite small businesses, but actually quite significant 
businesses and of course the interesting thing now in 
the way in which manufacturing has developed of 
course is an increased reliance on computers. 
Computer aided design is something that you now 
see in the smallest of businesses on _ that 
manufacturing side and of course it is very good to 
see its development because I think that is one of the 
key areas in which certainly as a Government we 
want to see progress because we can see that helping 
our competitiveness. But having said that, that is why 
there does need to be that concentration. 


Mr Beard 


127. Could you draw the distinction between your 
role in relation to the millennium bug problem and 
that of the Chancellor of the Duchy of Lancaster? 

(Mrs Roche) Yes, my role, Mr Beard, is to be 
responsible for the action and developments that we 
are taking with the private sector. As far as the 
Chancellor of the Duchy of Lancaster is concerned, 
he is responsible for the public sector. But clearly 
there is obviously room in that for discussion which 
is why, of course, the Prime Minister announced the 
launch of the Ministerial Group to be chaired by 
Margaret Beckett, the President of the Board of 
Trade. 


128. Thank you very much. How does the 
Government intend to monitor the level of 
preparedness of the private sector? 

(Mrs Roche) We believe as far as that is concerned 
that Action 2000 is going to have an enormous role 
to play in that and I know that already, Mr Beard, 
that this Committee has taken evidence from Mr 
Cruickshank and clearly they are going to have a key 
role in making sure that they get out to business all 
the information that they need of the tools that are 
available for them to solve this situation. It is a 
complex area because of course, depending on the 
sort of business, different applications will be needed 
and it is also quite clear that depending on different 
sorts of businesses there wit be different sorts of 
difficulty as far as sophistication of systems are 
concerned. So monitoring of that area is going to be 
important and I know that Mr Cruickshank has 
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spoken about that. One of the other things that we 
will also be doing is looking at the business link 
network. I have responsibility within the DTI, as the 
Minister responsible for small and medium sized 
firms, for the business link network. Now we 
announced a re-launch of that network in October 
and one of the key things I highlighted at that was 
that we would also be looking at the century date 
change problem. Now of course the advantage of 
that is that those business links do have the 
knowledge of their local companies, what they are 
doing, and I think that is something that is going to 
be very helpful to Action 2000 indeed. So in that 
sense there is an advantage in my being responsible 
for the two areas. 


129. What plans are there for immediate action if 
it becomes apparent that insufficient progress is being 
made in addressing this problem in the private 
sector? 

(Mrs Roche) I think the problem is so serious, Mr 
Beard, that I think we do have to make sure that 
action is taken. What I can assure you is that the 
Government will do all it can do to make sure that we 
act as facilitators and enablers. What is useful and 
very much an important component of Action 2000 
is, if I can put it this way, all the major players are 
there. The industry is there, the CBI is there, the 
banking community is represented and of course the 
banking community has played a very important 
part in this already. It has already been distributing 
a great deal of information to its business customers 
about this. So if you like all the key players are in 
there. There is, I think, a growing realisation, there is 
an awareness that there is this problem and that is 
very, very good. What we now have to do is translate 
it into reality and I think we have to have a number 
of different ways of tackling it. First of all we have to 
have an approach by sector so that we can use the 
supply chain. That is very important to us, so a very 
targeted approach. Second, we are very keen as well 
to go to chief executives as well. It relates to the 
supply side approach because we actually believe 
that going to the chief executives can have a very 
important role on that and that is certainly a major 
role that we see for Mr Cruickshank and Action 
2000. So to come back to your important question, 
Mr Beard, this is so important we cannot let it fail 
and the very important message that we want to get 
across, which is why I very much appreciate the 
opportunity to come to talk to you today and why I 
am personally taking on so many speaking 
engagements in this area, is to get this message across 
and to get it across as forcibly as we can do. What we 
do not want is to be inia situation where we scare 
industry so much it does not do anything. That 
would be the very reverse of what we want to do. We 
want to get a sensible message over to them that if 
they want their businesses to grow and prosper and 
they want to be in a position where they can be truly 
competitive, they have to seize this issue at the 
moment. 


130. We did hear earlier from the CBI that there 
seems to be a reluctance of some companies to say 
what the state of preparedness is for fear of damaging 
their stock price or their share price or trading 
conditions. Are there any ways round that, do you 
think? 
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(Mrs Roche) I can understand that being a worry 
because of course in a sense of market advantage and 
having knowledge of this is an important issue. That 
is where I think that Action 2000 can play its role and 
I also think that because we have as the Chairman of 
that organisation, Don Cruickshank, who is a man 
who is well respected by both Government and by 
industry, he can play a role in helping to dispel any 
fears there. And of course the fact that. we have the 
CBI as part of that and using its influence is very, very 
important indeed. But we need to get a message over. 
If I can just say to you, one of the things that a few 
months ago really alarmed me when I was sitting next 
to somebody, a businessman, a managing director of 
a good medium-sized company who I greatly respect 
as an extremely competent businessman and he said 
to me that until comparatively recently he thought 
the whole issue was hype got up by the industry and 
that really alarmed me. He now realised it was not 
and he had to do something about it, but that worried 
me. That is why, if you like, we need to have a focus 
on industry as a whole and that is why for us Action 
2000, a broad based organisation, is just very 
important indeed. 


Mrs Spelman 


131. You mentioned the Ministerial Group on the 
century date change. What precisely will be its role? 
Have any objectives been set for it and by what 
criteria will you judge its success? 

(Mrs Roche) Yes, it will. As I said, it will be chaired 
by Margaret Beckett and the whole point of it is to 
drive action across the private and public sector to 
make sure that our national infrastructure is not 
damaged by the problem. Now what I think would be 
very useful is that Margaret Beckett and myself are 
co-ordinating action with regard to the private 
sector. David Clark, as the Chancellor of the Duchy 
of Lancaster, is driving on the public sector. But 
clearly there can be lessons that can be drawn about 
good practice between the two and that is where the 
Ministerial Group will be very important. The other 
thing, I think, that is very important about it as well 
is that it illustrates just how seriously the United 
Kingdom is taking the issue. I had the opportunity 
recently to speak about the issue to the Telecoms 
Council and again they are very interested about 
what we are doing in the United Kingdom and I 
think it gives a very graphic example of what 
Government can do. It will enable us to spread best 
practice, but I think it also sends a very powerful 
message itself about the Prime Minister’s concern in 
this matter and the fact that we have a ministerial 
task group force. 


132. What funding, or rather support, will the 
Government provide to assist companies, 
particularly the small- and medium-sized enterprises, 
to meet the costs of ensuring their systems are 
millennium compliant if they are not able to do this 
for themselves? 

(Mrs Roche) As far as funding is concerned, the 
Government is giving up to £1 million in this 
financial year for Action 2000 and it will provide the 
same sums in the following years to resolve the 
problem. Clearly at the end of the day it is for 
companies themselves to sort out the problem and as 
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far as that is concerned that clearly is a matter not for 
intervention, but is a matter for the private sector. 
However, may I say in that that what we will be doing 
with Action 2000 is provide help lines and there are 
possible plans for a web site to provide information. 
There is the Government’s very own Enterprise Zone 
which we launched on 4 November which can 
signpost, there will be information, we will be using 
the business link network. We will also, via Action 
2000 and the people involved in the Advisory Group, 
have access to the banks and other organisations. So 
there will be an enormous amount, if you like, of 
advice and guidance for those companies and we 
believe that we are in the forefront—certainly as far 
as the rest of Europe is concerned—on what we are 
doing here. 


Dr Gibson 


133. Minister, do you think perhaps this is all too 
much for one man to handle all this interaction 
between the different bodies? Mr Cruickshank has 
had his job expanded from a week ago, I think? 

(Mrs Roche) Yes, itis not just for one man. I havea 
great deal of admiration for Mr Cruickshank’s skills, 
but it is not just him. Mr Cruickshank we have taken 
on as our very high profile Chairman and he will be 
doing that job, but he will also be supported by a full 
time director and indeed Mr Cruickshank has just 
appointed an acting director. There will also be other 
full time staff. Clearly many of them will be project 
directors, team leaders as well; people who are well 
aware of the industry, but also well aware of business 
becasuse I come back to this. It is very important 
when you are trying to talk about what needs to be 
done that we just do not tackle it from the point of 
view of IT people talking to other IT people. The 
people we need to get involved are some of the people 
in business who are not necessarily IT people, but 
people who hold the purse strings for those 
businesses, the finance directors, because at the end 
of the day we know that these are the people who 
make the decisions and we do have to get it over to 
them. So it is very much a broad-based organisation, 
Dr Gibson. 


134. I know you have said you intend not to fail, 
but at some point you may find that some people are 
not listening. Have you got some back-up tactics 
other than persuasion? 

(Mrs Roche) I think we will find, certainly I would 
suggest that from January onwards, the pace is going 
to hot up. That is certainly my intention, it is 
certainly my prediction and I expect that as that 
becomes more and more of a realisation about what 
is going to happen, what people are going to want to 
know is—help. Now what I do not want them to do 
is to panic; that is the worst thing they could do. 
Having had the level of awareness that we have got— 
the survey showed that the level of awareness is 
high—the worst thing they can do is bury their heads 
in the sand and say: “Well, what do I do now?”, so 
what I will be focusing on is saying—you know, it is 
a bit like Dad’s Army; “Don’t panic, don’t panic, 
help is at hand”—and that is what we can provide. I 
think that when in the next couple of months or so 
when we see the fruition of Action 2000’s plans which 
Mr Cruickshank outlined to you—and we would 
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also be very happy if that is helpful, Dr Clark, to give 
you an update on that as that progresses—we will see 
more and more businesses trying to do that. But also, 
I think we will be seeing much more activity because 
I think you will have, for example, the banks 
themselves saying to their business customers: “What 
are you doing about millennium compliance?”. We 
will be seeing the PBAs, the Personal Business 
Advisers in the Business Links advising their business 
customers about that. I do not want to make it sound 
too optimistic because I think there is a mountain to 
climb here. We will be seeing much more of a flurry 
of concern and what we have to do is to make sure 
that all the initiatives that we are doing with industry 
are up and running so that they can meet those 
challenges. 


Mr Atkinson 


135. Minister, you rightly stress the very real 
seriousness of the problem and the risk that 
businesses will fail and the Chairman has pointed out 
that it has been suggested that 29 percent of GDP 
would be at risk, perhaps rising to 37 percent if 
businesses do not respond in time. So it was 
obviously disappointing to me when I met you ten 
days ago to ask for Government support for my Bill 
that you declined it, suggesting that it would 
represent a greater burden on business, which I found 
rather strange because, as I said to you, what greater 
burden on a business than to go bankrupt because it 
has not addressed the problem which my Bill would 
require company directors of businesses to do. I felt 
that the Government had nothing to lose but 
everything to gain for this country by supporting my 
Bill. Could you enlarge upon your opposition to 
what my Bill proposed? 

(Mrs Roche) I will certainly do that, Mr Atkinson, 
but can I say first of all thank you, it was a very 
helpful meeting that we had, and let me say at the 
beginning if I may without causing you to blush that 
I certainly acknowledge very much that you were I 
think the first Member of Parliament to raise this 
very important issue on the floor of the House and 
outside and I think if I may say so your 
Parliamentary colleagues owe you a debt of gratitude 
for the work that you have done in this area and I 
very much acknowledge and appreciate that. 


136. Thank you? 

(Mrs Roche) As far the Bill itself is concerned, the 
reason why I did not feel able to give Government 
support to it is that I do not believe we need 
additional legislation in this area. If we are going to 
get companies to do it they will do it because it is in 
their self-interest to do it and I actually thought just 
putting an additional legislative burden on there that 
it would take up time and it would not really deliver 
the result. I think, you see, that we are getting the 
impetus there anyway. We are getting the impetus 
there from auditors who are already saying to 
companies before they sign them up: “Are you 
millennium compliant?” and as I have already said, 
we are getting it from the banks, so it is coming 
anyway from a number of Sources already. I think 
what you have said publicly in the past, Mr 
Atkinson, quite really when you framed the Bill and 
when you actually framed it originally in the last 
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Parliament, that one of the reasons it was there was 
to raise discussion and awareness of the issue and I 
think that is quite right. The fact that you framed it 
and campaigned for it, that is what it did. I think 
actually that the picture has moved on a bit now 
because what the survey evidence shows is that there 
is a level of awareness, but what people have not done 
is translate it that awareness into actions. So 
although, Mr Atkinson, we might not agree on the 
legislation I think we agree generally on some of the 
things that need to be done. May I say that some of 
the areas which IJ think we could very usefully take up 
that you have also suggested is the work for example 
that I know you have done in your own constituency 
of contacting your own businesses and finding out 
what they have done, signposting them to offers of 
help and certainly I very strongly believe that this is 
a contribution that Members of Parliament could 
make across the board because there is no doubt that 
Members of Parliament on all sides of the House in 
their individual capacities as constituency Members 
of Parliament do have very good contact with local 
companies, very many of them with big companies as 
well. So again that is a route into the supply chain. I 
think as well you have a situation where constituency 
Members of Parliament are taking the sort of interest 
that you have, Mr Atkinson, in that way that we can 
look at similar schemes such as the one that you have 
done in your own constituency and that is certainly 
one that I have passed on to Mr Cruickshank and to 
Action 2000. 

Chairman: Mr Atkinson, do you want to stop 
while you are winning or would you like to ask 
another question? 


Mr Atkinson 


137. lam going to ask another question! Of course 
I greatly appreciate the Minister’s kind comments 
and let me tell her that whilst I appreciate the reasons 
why she feels unable at this stage to support my Bill, 
given the widespread complacency and ignorance on 
this issue which is coming to the attention of this 
Committee, can I tell her that the Bill remains on the 
floor of the House of Commons. I shall be there 
almost every Private Member’s Bill Friday to move a 
second reading, so if you feel that the need is there 
then it is still ready and waiting for you. Now for 
another question and that is that given the 
seriousness of the problem, is there no justification 
for a Prime Ministerial statement which would in 
itself give greater publicity to the problem and the 
need to take action; take action, not to be aware of, 
but to take action in response to it? Another question 
is ought we not to co-ordinate and arrange a national 
test day given one of your prime messages is we have 
to allow sufficient time for testing on the action that 
you have taken to ensure that that action is adequate 
before the time runs out in two years’ time. We ought 
to have a national test day, maybe on | May 1999? 
That is a suggestion I put to you. 

(Mrs Roche) On the second question I will say 
something and perhaps bring in my colleague on 
that. On the first point, the Prime Minister—I think 
the point is an important one and the Prime Minister 
has very much shown his concern in this area. It was 
an issue that he raised in Cabinet and an issue that he 
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spoke about to all his Cabinet colleagues and of 
course that was made public and mentioned and you 
then had the statement from the Chancellor of the 
Duchy of Lancaster as had been planned on this issue 
because the Chancellor had been collecting reports 
from all Government departments. Then of course 
you had the announcement of the setting up of the 
Ministerial Group so clearly that has come from the 
Prime Minister and you have seen very much the 
Prime Minister’s commitment and involvement, very 
importantly because the Prime Minister recognises 
the very important effect this could have on industry. 
As far as the second point is concerned, Mr 
Atkinson, about the test day I think this is something 
that Action 2000 are considering, but perhaps I could 
bring Mr Pride in here if I may, Dr Clark? 

(Mr Pride) Thank you. We have passed on the 
suggestion to Action 2000 as one way of raising 
awareness and also co-ordinating testing and they 
will be looking at that. It is very important more 
generally that testing is encouraged, that companies 
realise the amount of time that testing is going to take 
even when the work has been done. That is an 
important issue and message that we are trying to get 
across and there may well be scope for Action 2000 
co-ordinating information about when particular 
tests are being done by particular companies or 
collaborative tests on a sector by sector basis. So I 
think there is an important issue here and they will 
certainly be looking at it. 


Mr Jones 


138. Minister, may I turn to the problem of the IT 
skills shortage. In their submission to us ICL 
mentioned that a recent Millennium Skills Shortage 
Conference, organised by the DTI, concluded that 
the growing shortage of staff with IT skills would 
increasingly affect the Year 2000 activities. It is 
already causing organisations to pay inflated rates to 
retain and acquire staff with appropriate skills. I 
myself was offered £150,000 to go and use some of my 
cobol and assembler expertise. My wife was reaching 
for the Chiltern Hundreds! Seriously, the CBI are 
also saying that both within companies and across 
industry there is a lack of skilled specialists able to 
tackle particularly the embedded chip issue. What 
does the Government intend to do to try and alleviate 
this shortage? 

(Mrs Roche) Well, Mr Jones, this is a very serious 
problem, it really is and the Summit that you referred 
to is one that I chaired in the summer and we do 
regard it as a great problem. Clearly it is an area that 
the industry itself is going to pay a lot of attention to 
because it knows it needs the necessary skills base to 
do it. It is certainly an important part of the Action 
2000 agenda. I met with Mr Cruickshank earlier this 
week as part of a wide-ranging discussion and this 
particular subject, I think it would be fair to say, 
occupied a fair amount of time as we regarded it as so 
important. There are a number of different initiatives 
that are being looked at by companies in this area. 
Women returners, family friendly practices to 
encourage part-time work, enormous numbers of 
things that can be done with young people and 
certainly when we had the Skills Summit that you 
referred to in the summer, those very same issues 
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were mentioned by industry itself as being very 
important. We do need the people there. There have 
been various estimates, quite alarming estimates, 
that have been given about the numbers. It is 
precisely difficult to know quite what the vacancy is, 
but I have certainly had it suggested that it is at about 
50,000 more in terms of the gap that there is. It is 
difficult to be able to verify the figure, but it certainly 
is a figure that has been suggested by some in 
industry. So it is something that we are concerned 
about. We are certainly talking to our colleagues in 
Education and Employment about it, but it is going 
to be a large part of what Action 2000 has to do. 
Again, it is looking at the Projects Skills Office, which 
is part of it, trying to have a channel of ideas. At the 
end of the day clearly it is one of those areas that is a 
matter for industry, but I also think it is one of the 
areas where the Government can make a significant 
contribution. 


139. The introduction of the single currency will 
clearly exacerbate the situation of skills shortages 
and ICL again point out that an important aspect of 
dealing with the shortages is matching any available 
people with the relevant skills to the organisations in 
need of them and they are suggesting that the 
Government could consider providing a central 
directory service to support this. Do you think that is 
a possibility? You mentioned education; do you 
think there is a possibility that colleges and 
universities could release some of their students, and 
indeed staff, to help overcome this skills shortage? 

(Mrs Roche) I think again I will bring Mr Pride in 
if I may? But I think there are a number of things that 
can happen in this area. I think what is very 
important is that clearly the skills needed to sort out 
issues like the Century Date Change problem are 
very specialist skills. They are quite difficult to train 
people in in a very quick period of time, but if we add 
to the overall number of people in the industry that 
clearly, if you like, has a pyramid effect and it then 
frees people to do other things, so certainly we do see 
one of the roles for Government, working with 
Action 2000, part of the Action 2000 role, as acting 
if you like as a clearing house for some of these ideas 
and we actually think we can work with industry very 
profitably in this area, but it may well be that Mr 
Pride may have some other things to say on that. 

(Mr Pride) Yes. Following the Conference that 
Mrs Roche chaired in July, the Department gave 
some funding to set up a Skills Project office to look 
at the whole range of ideas which would tackle the 
skills shortage problem. That office has now been 
brought under the aegis of Action 2000 and they 
produced an initial report. I think that when one puts 
training and bringing people back into the 
industry—people who have retired, people who have 
taken early retirement, women who have left to have 
families—if one puts all those ideas together, which 
is what the Skills Project office has tried to do, then 
the task is to identify those that are going to have a 
short-term impact early enough to help us deal with 
the Century Date problem and that means that some 
ideas are more promising on that narrow point than 
others. That work is proceeding; I cannot really say 
today which of those ideas are going to be taken up, 
but it is very much on the agenda of Action 2000. It 
is something that I know Mr Cruickshank personally 
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is very concerned about and he will be submitting 
advice on this, as on many other questions, to 
Government as to what can be done. If I could just 
add one brief point which is that if it is not possible 
to generate as many additional people on the sort of 
time scale that is necessary then I think that 
reinforces the message that we have been trying to 
put across to industry that they have to prioritise, 
that companies really have to concentrate on the 
business critical, the environmental critical, the 
health and safety critical systems where a problem 
may exist. That is why senior management has to be 
involved in the Century Date problem. That is why it 
cannot just be left to the IT department or the 
technical people. It is senior management who have 
to say: “Right, these are the areas where we really 
must concentrate the limited resources that we have”. 
Chairman: Thank you very much indeed. Mr 
Turner? 


Dr Turner 


140. Minister, in enacting legislation Governments 
can also place strains on the IT industry and 
amending the Data Protection Law for instance 
would have considerable implications; so to what 
extent is the Government prepared to examine and, 
if necessary, amend its own legislative problem so 
that it does not place excessive burdens on the IT 
industry to enable it to cope with the 2000 problem? 

(Mrs Roche) Mr Turner, I think that is something 
we are going to have to increasingly look at. I think 
that is one of the great advantages of the Ministerial 
Group that because we have that you will have 
Ministers in all departments becoming increasingly 
aware, not only of what their own departments have 
to do, which is one element of course of that, but also 
the problems as far as industry is concerned because 
that is going to be the very positive advantage of that 
which will make us think about what we do as 
Government and what we do in adding in terms of 
things that the industry has to do. So I think that will 
be one of the great strengths of the Ministerial 
Group. 


141. Do you think the introduction of the single 
currency in the year 2000 is going to have any great 
impact on our ability to be ready for the Century 
Date Change, because after all, even if we are not 
part of Euro when it happens in 2000, none the less 
we are going to have to do business with trading 
partners that are, which is going to have considerable 
IT implications? Do you think that there is a case for 
arguing a delay in the introduction of the Euro so 
that we can get past the Year 2000 problem before we 
go into the European currency? 

(Mrs Roche) 1 think they are two different issues 
and it is difficult to say precisely the effect on both, 
but I think you are right to say that businesses will be 
preparing for both. Certainly the DTI played a role 
as far as looking at the Chancellor’s Advisory Group 
for preparation as far as EMU was concerned about 
systems, but I think it is difficult to say precisely what 
would be the effect on businesses. Mr Pride may have 
some points as far as that ix concerned. 

(Mr Pride) Yes, I represented the Department on 
one of the sub-groups that was reporting to the 
Chancellor of the Exchequer’s Business Advisory 
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Group on EMU. I was sitting on the Working Group 
looking at IT implications in particular. We have just 
submitted our report and perhaps I should not say 
too much about it, but I can tell the Committee that 
the interaction between Century Date and EMU was 
very much in the minds of the people who sat around 
the table and that point is taken on board in the 
report that we put up to the main Advisory Group. I 
think that one of the question marks in this area is the 
extent to which businesses will have to begin to adapt 
their system even though at a particular point in time 
the United Kingdom is not actually a member. I 
think the general expectation across industry is 
probably that: “Well, I do not need to do anything 
just yet. I do not need to do anything until the United 
Kingdom actually joins, if indeed it does” and I think 
what we recognised in our group is that many 
businesses will have to begin to adapt their systems to 
cope with the Euro on the time scale that is 
determined by the countries that join on day one. 
Many businesses have trading relationships with 
companies elsewhere in the European Community. 
Many businesses are supplying to the United 
Kingdom subsidiaries of major European groups 
and those major European groups may insist upon 
trading in the Euro from day one, so many, many 
businesses in the United Kingdom will have to start 
thinking about what they need to do on the start date 
in 1999, whether the United Kingdom is a member at 
that date or not. On the other hand, many businesses 
may not need to take any steps unless or until the 
United Kingdom actually joins, so it is a question 
that each business has to answer for itself, but our 
concern I think is that many smaller businesses are 
just assuming that this is a problem far in the distant 
future that they do not have to worry about just yet 
and that is not true. 

Chairman: Minister, if I may just conclude on a 
final question because we are now touching on 
European currency and European matters? Have 
you any idea at all what our colleagues in the 
European Union are doing and I do believe that you 
requested that the European Commission should 
propagate information about what they are doing so 
that all Member States may have an awareness of 
what other Member States are doing. I wonder if you 
would just care to make a few comments on that 
particular point? 

Mr Atkinson: Or issue a Directive on the matter! 


Chairman 


142. Our legislator would like you to do more than 
talk about it? 

(Mrs Roche) Thank you, Dr Clark, 1 would be 
delighted to because I really regard this as a very 
important area because very importantly following 
on from what Mr Pride has said, what is very 
important in this is that we cannot bury our heads in 
the sand as a country. We cannot say we are okay and 
therefore it does not matter what everybody else is 
doing in other countries, because of course it is our 
trade that is very dependent on that, so again it is 
enlightened self-interest as far as we are concerned. 
You are absolutely right, Dr Clark. I requested that 
this matter be put on the agenda for the Telecoms 
Council on | December and I sit on that Council 
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representing the United Kingdom and I will have the 
privilege of chairing that Council from 1 January 
when the United Kingdom takes on the Presidency. 
I have already done two things really. First of all I 
make it an absolute point that whenever I meet my 
opposite numbers who are also Telecoms Ministers 
to always raise the issue so it is there in all those 
bilateral meetings. We had a very good discussion 
about it in the Council on 1 December. First of all I 
was really delighted about the fact that we raised it, 
got a warm reception because I think it may well be 
that in the past this has been something that the 
United Kingdom has been concerned about, but 
perhaps somehow other countries have not seen it as 
quite the issue as we have. Again I am very pleased 
that it did receive a very warm reception from other 
Member States. It also received a warm reception 
from the Commission from Commissioner 
Bangemann. The Commission have issued a paper 
and I think there is going to be a meeting—I think it 
is on 19 December—which 1s actually taking place on 
that issue when we will be able to look at it. Again 
what was interesting—and I am sure Dr Clark if it 
would be helpful we would be able to give you some 
information—was that other countries came 
equipped with bits of paper saying: “Well this is what 
we are doing” and we certainly had that happening 
around the table. So what I will certainly do and 
certainly after that meeting is to make available a 
summary of what other countries are doing and to 
sort of put that into your consideration and what I 
can also assure the Committee what I will also do is 
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to make sure that this continues to be raised during 
our Presidency as well because for me it is coming at 
a very important time as far as this vital issue is 
concerned. So we will continue to press it and we will 
keep you updated on this because I have to say I do 
regard it as absolutely essential as far as international 
trade and competitiveness is concerned. 


143. That is a most significant note on which to 
finish, Mrs Roche. The Committee is very grateful to 
you, and indeed to Mr Pride too, for coming along 
this afternoon. You have promised us two things if I 
may remind you; you promised us first of all that you 
would send us an update of Mr Cruickshank’s remit 
and initial findings and you have just a moment ago 
offered very kindly to send us the notes that you get 
from the Commission in due course and we will be 
very, very pleased to receive those. May we thank 
you for coming along to see us this afternoon. May 
we congratulate you on not only your knowledge of 
this particular subject which is only perhaps a small 
part of your overall portfolio and also say how well 
you have answered our questions. You have been 
very kind to one of our Committee members; I see no 
reason why we should spare your blushes as well! 
Thank you very much indeed for all the help you 
have given us and we wish you well in the difficult 
task you have ahead of you in this particular field. 

(Mrs Roche) Thank you, Dr Clark, you are very 
kind. Thank you very much for the opportunity. 

Chairman: The meeting is closed at 5.45 p.m. 
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Memorandum submitted by Shell UK Limited 


Shell UK Limited, a company of the Royal Dutch/Shell Group, is engaged in the United Kingdom in the 
exploration for and production of oil and natural gas, in oil and chemicals manufacturing, and in the 
marketing of the resultant products. The company is organised into three business sectors—Shell UK 
Exploration and Production (Shell Expro, or Upstream); Shell UK Downstream Oil (Downstream) and Shell 
Chemicals UK Limited. 


Because these business sectors cover such widely differing activities, involving complex infrastructure 
which is quite distinct and unique, some of the paragraphs in the following memorandum have been split to 
give the Committee the widest coverage of Shell UK’s experience to date of the Year 2000 problem. It focuses 
on the two main businesses of Shell UK which are most relevant to the Committee’s inquiry. 


Shell Expro, operating on behalf of Shell UK Limited and co-venturers, is one of the largest offshore 
producers of oil and natural gas in the UK with an interest in more than 30 producing fields and their 
supporting offshore infrastructure, together with three onshore plants at St Fergus, Mossmorran and Bacton. 


Shell UK Downstream Oil manufactures a full range of the highest quality fuels, lubricants, petrochemicals 
and bitumen operating out of two refineries, 16 large distribution terminals and around 1,700 retail sites. 


1. INTRODUCTION 


Shell UK has been actively involved in addressing the “Year 2000 Problem” since early 1996, as part of a 
worldwide Shell Group initiative. Shell UK’s experience, especially in the area of embedded systems, has been 
instrumental in developing the “Year 2000 Survival Action Guide”, a document which provides practical 
direction for Shell Group companies. 


2. SUMMARY 


The Year 2000 problem is multi-faceted, and penetrates far beyond office computer systems and data. In 
the Upstream Oil and Gas sector its main impact is with embedded systems controlling production plant, 
whereas in Downstream, business systems are also significantly impacted. We believe successful Year 2000 
projects require a high profile and genuine support from the Board. If tackled early, methodically, and with 
enough commitment, the critical exposure areas can be successfully addressed. As well as looking inward, 
companies should be aware of the potential problems that can stem from the supply chain, and obtain 
assurance from their key suppliers and customers of a well-found compliance plan. Other external risks relate 
to the ability of some vendors to resource the demand that will accrue for remedial work, and of others to 
make their products compliant. 


3. PROBLEM IMPACT 


The problem breaks down into three distinct areas of impact. Asset Integrity embraces the physical 
infrastructure, particularly control and monitoring systems in offshore platforms, onshore gas fractionation 
plants, refineries, retail sites and offices. Business Computing covers the effects on electronic business 
information systems and the data that drives them. Commercial Integrity refers to our implicit dependence 


on third parties and the potential effects on our operation, of failure on their part to overcome the Year 2000 
problem. 
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4. TARGET 


The project is targeted for completion by end-1998, leaving a year for operational testing, contingency 
planning and as a buffer against slippage. Eradication of all Year 2000 problems would be an unrealistic 
target. Our aim is to develop and implement action plans for all perceived threats, to achieve assurance levels 
which reflect, in each case, the business criticality of the threat. This will reduce the effects of the Year 2000 
problem to manageable levels in all areas, a target we are confident can be achieved. 


5: COST 


The direct cost of addressing Shell UK’s Year 2000 exposure is estimated in the range £30 to £40 million, 
most of which will be spent on Asset Integrity. The estimated spend should not be confused with the 
magnitude of the problem which, if ignored, could cost many times the remedial outlay. If a single offshore 
platform were to fail, deferred production could run to £1 million per day. If the St Fergus gas fractionation 
plant were to fail, a large part of the North Sea would be instantly inoperative. 


6A. SHELL EXPRO ORGANISATION AND RESPONSIBILITIES 


In its first year the programme has been run as a number of independent projects dealing with all areas of 
exposure. It has been co-ordinated by a full-time resource and directed by a multi-functional Steering Group. 
In moving to the implementation phase, the project has been reorganised on a pan-Expro basis, the manager 
having single-point responsibility and reporting to a senior Director. This will ensure that the work is 
prioritised consistently, that it has the necessary profile to produce the required action, and that schedules 
and complex logistics are fully co-ordinated. The role of the team is to organise, plan, schedule and facilitate 
the work. Responsibility for achieving compliance lies firmly with the owners of the Assets, Systems and 
Business Processes affected. 


6B. SHELL UK DOWNSTREAM ORGANISATION AND RESPONSIBILITIES 


Work commenced in 1996 and concentrated on Business Information Systems. As understanding of the 
Year 2000 grew, two further projects were instigated to address the Asset and Commercial Integrity issues. 
These projects have discrete project managers whose roles are to co-ordinate and facilitate corrective actions 
within the appropriate areas of the business within which lies ultimate responsibility for compliance. All three 
Year 2000 projects report to a Steering Committee which is chaired by the Finance/IT director who is a 
member of the Shell UK Downstream management team. 


7. METHOD 


We have developed a number of interlinking, innovative methods, based on well-proven hazard analysis 
techniques, which allow all facets of the problem to be tackled methodically and consistently. The philosophy 
behind all our methods is to inventorise, assess, test, remedy, plan for contingencies. To date we have 
completed the analysis phase for many of our installations, enabling us to create a comprehensive and 
accurate view on the threats and necessary remedies. 


8A. SHELL ExprRoO ASSET INTEGRITY 


This aspect represents by far our greatest exposure. A typical offshore platform or onshore gas plant uses 
50-100 definable “embedded systems”, meaning sets of electronic code used to control equipment and which 
cannot be altered by the users. As many as 10,000 individual microchips can be involved. Impact analysis has 
shown that about half the identified systems are critical to the business, ie loss of their function would result 
in significant production loss or environmental effects. None has yet been found to have direct safety 
implications, as our safety-related systems all have low-technology fallback systems. Remedial action has to 
be agreed, planned and scheduled with each of 60-plus vendors, a very significant logistical exercise. 
IT/Telecommunications infrastructure is a specialised sub-project of Asset Integrity, using the same method. 
In comparison to the main project we expect the incidence of non-compliance to be similar, but anticipate 
the problems being easier to remedy, as there is less customisation of the equipment, and non-compliance 
should be fixable via standard upgrades. 
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8B. SHELL UK DOWNSTREAM ASSET INTEGRITY 


As with the upstream, asset integrity is likely to be the most difficult and costly area to resolve. The impact 
can range from refinery process control and safeguarding systems, via pipeline control and terminal 
operations, through to commercial and retail activities. Retail is complicated by the sheer number of sites 
involved—c. 1,700. Each individual business sector is investigating its own area of responsibility with the 
project manager providing guidance and co-ordination. Prime concern is safety and environment, 
particularly with the refineries. Thereafter, remedial action is based on business criticality. 


9a. SHELL EXPRO BUSINESS COMPUTING 


The most widely understood aspect of Year 2000 problems, this is unfortunately believed by many to 
constitute the whole problem. In the Oil and Gas industry, embedded systems are the highest profile issue. 
Remedying Shell Expro’s Business Computing problem, although much smaller at £2.5 million, is still 
important. This is less than the original estimate for various reasons including: the replacement of many 
vulnerable systems by an integrated business operations package which is expected to be fully Year 2000 
compliant; use of systems supplied by Shell Central Offices, for which we only bear a fraction of the remedial 
cost; the relatively high integrity of code in our Business Information systems; and the low incidence of dates 
in data processing compared to a typical retail or financial organisation. 


98. SHELL UK DOWNSTREAM BUSINESS COMPUTING 


This aspect of the Year 2000 project encompasses all Mainframe, Midrange and PC based applications. 
These traditional application areas can largely be categorised into the areas of Finance, Marketing, Retail, 
Commercial, Human Resourcing and Manufacturing. The cost of remedy within Shell UK Downstream is 
currently estimated at £3 million. This amount is subject to change as it is recognised that the nature of the 
Year 2000 problem is one of ongoing problem discovery as increasing numbers of applications are progressed 
through the compliance process. The basic corrective methodology of inventorise, assess, fix and test has been 
applied to our applications and systems on a priority basis. The elements considered in the setting of priority 
are business criticality, estimated corrective effort and event horizon (the date that a system may fail because 
of a Year 2000 problem). The bulk of systems will be corrected by means of an upgrade process, however 
several have been identified as targets for replacement. Given the short timescales involved it is essential that, 
for those systems being replaced, a contingency plan be developed as a precaution against non-delivery of the 
new system(s). In some cases this has resulted in some critical systems being subject to both a parallel upgrade 
and replacement strategy. The resourcing strategy centres around the use of existing staff supplemented by 
contract resources supplied via agencies. Two things are evident: the costs of these resources are rising; and 
for some of the lesser known development tools and languages, there is an increasing scarcity of appropriate 
skills. This not only presents problems in procuring additional staff but also presents difficulties in retaining 
existing staff. Some smaller organisations may face severe problems in achieving compliance if they are unable 
to meet manpower costs. Considerable effort is required to ensure that the underlying “system architecture” 
supporting the application layer becomes compliant. Significant dialogue with software and hardware 
suppliers to establish the compliance status of their products is taking place, with a mixed degree of success. 
It is clear that some companies are more advanced in their ability to (a) commit to a compliance strategy and 
schedule, and (b) deliver the corresponding upgrades. It is vital that the status of the underlying architecture 
is clearly understood as this must be taken into consideration when considering which corrective strategy to 
adopt. The failure of computer software and hardware manufacturers to deliver a clear statement of intent 
will compromise the ability of organisations to deliver fully compliant systems. 


10A. SHELL ExPRO COMMERCIAL INTEGRITY 


In Upstream Oil and Gas we are particularly vulnerable to third parties’ Year 2000 problems, because so 
many of our operations are contracted out. Our objective is to gain assurance that each key third party has 
a viable Year 2000 compliance plan. This applies to customers as well as suppliers, as failure on their part to 
address the problem could mean that they are unable to take our products. Collaboration helps share the 
load. As well as pursuing third parties directly from Shell Expro, two powerful fora have been set up, within 
the Shell Group and the UK Offshore Operators Association (UKOOA). The main purposes of these 
networks are to use the combined weight of their members to initiate action among key third parties, to share 


technical information, and to ensure that the companies involved are all pursuing the problem in a 
consistent manner. 
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108. SHELL UK DOWNSTREAM COMMERCIAL INTEGRITY 


The survival of key suppliers and customers through and beyond the Year 2000 is of extreme importance 
to Downstream. Initiatives are taking place to encourage these organisations to adopt appropriate strategies 
to tackle this problem in a timely manner. We recognise that this must be done in a sensitive and efficient 
manner so as to minimise the non-productive workload burden that is being placed on many organisations 
in responding to such inquiries. As such we have avoided the use of lengthy and complex questionnaires. 
Instead a simple letter in conjunction with the effective use of existing personal one-to-one contacts have been 
employed. 


11. LEGAL ASPECTS 


Although inclusion of watertight warranty clauses in all new contracts is a must, the only sensible approach 
is to pre-empt litigation by ensuring as far as possible that the products and services we use are unaffected by 
the problem. Litigation against suppliers of deficient products or services will. not begin to compensate for 


our losses and may well put them out of business, helping neither party. 


12. IssuES 


The main issues that we currently face are: 


— lack of awareness industry-wide of the seriousness of the problem; 


— non-compliance in control equipment and infrastructure systems, coupled with lack of vendors’ 


support resources; 


— matching availability of resources to platform and refinery shutdown schedules, to avoid 
production deferrals solely for Year 2000 work; 


— the need to match assurance levels to perceived criticality; 


— guaging the effects of potential failure in the complex network of interdependent IT and 


Telecommunications systems; 


— providing effective and comprehensive test mechanisms for systems which are sometimes very 


complex in their architecture; 


— containing the problem so that new equipment is proved compliant before being installed; 


— contingency planning; and 


— obtaining and retaining appropriately skilled resources to effect a Year 2000 programme of work. 
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Examination of Witnesses 


Mr MALCOLM BRINDED, Oil and Technical Services Director, MR DAviD THOMSON, Year 2000 Co-ordinator, 
Shell UK Exploration and Production, and MR RIck JAcoss, Year 2000 Business Information Systems 
Manager, Shell UK Downstream Oil, Shell UK Ltd, were examined. 


Chairman 


144. Mr Brinded, good afternoon. Welcome to you 
and your colleagues from Shell. Perhaps before we 
start the questioning, you might like to introduce 
your two colleagues to us and tell us what your 
responsibilities are in Shell so that we can know a 
little bit more about you before we start our session. 

(Mr Brinded) Good afternoon, Dr Clark, ladies 
and gentlemen. I am the Oil and Technical Services 
Director for Shell UK Exploration and Production. 
We call ourselves Shell Expro and I will probably use 
that phrase. That is the upstream company in the 
United Kingdom which looks after oil and gas 
production platforms and gas plants in the United 
Kingdom. My two colleagues are David Thomson 
who is the Year 2000 Co-ordinator for Shell Expro, 
the upstream company, and Rick Jacobs who is the 
Year 2000 Co-ordinator for the downstream part, 
which means the refineries, petrol stations, the 
marketing and commercial activities. 


145. Thank you very much indeed. Welcome to all 
of you. We will direct questions to you, Mr Brinded, 
and should you wish to invite one of your colleagues 
to take the question on or give a supplementary 
answer, that is entirely for you to decide. I wonder if 
you could try and give us some idea of the size of this 
problem, the “millennium bug” as it has been called 
by some. If Shell had decided to do nothing and just 
continued on its normal course of business, what do 
you think the effect would have been when we came 
to the year 2000? How would Shell and indeed Shell’s 
customers have been affected had Shell done nothing 
about the millennium bug? 

(Mr Brinded) I think had we done nothing then 
there would have been serious consequences in terms 
of failure to continue to supply oil and gas. I think 
what I want to stress at this point is that we have done 
something and we have done quite a lot. 


146. We know you have done a lot and you are 
amongst the leaders or we would not have dared ask 
you the question! So from a position of strength can 
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you give us a bit of a Doomsday scenario so that 
when we write our report we can have some idea that 
this was not an expensive game you all played and 
had you done nothing there would have been a 
serious situation for your company and our country. 
Because we know you have done a lot and you will 
not be embarrassed by going into this scenario, we 
can ask you that. There are some companies that we 
would rather not have asked that question. 

(Mr Brinded) Let me stress that it would have been 
unlikely to cause any safety consequences in our 
installations because there are three facets, as we put 
in the submission, to the problem and we have found 
it easier to divide it into those three and manage 
through those three: the business computing issue; 
the asset integrity issue; and the commercial integrity 
issue or supply chain issue. Taking them one by one, 
the business computing issue, which is financial 
systems, planning systems and so forth, had we failed 
to do anything there it is very likely we would have 
had all sorts of problems with automatic payments, 
invoicing, our accountancy structure and our 
procurement structure, so we would not have been 
able to place orders, make payments and so it would 
impact our business significantly that way. That is 
the most widely recognised and understood area; it is 
business software. It is being tackled, I think, very 
widely. As we got more into the issue over the past 18 
months we realised that the second area, what I call 
asset integrity, was probably more significant. It may 
be helpful if I tell you a little bit more about that as 
I see it. That is really the issue of embedded chips or 
embedded intelligence in all sorts of equipment 
ranging from items of equipment you would have in 
your own home like the video recorder or the engine 
management system you would have in your car, 
through to the control systems we have on our 
offshore platforms which control compressors, 
generators, they meter our production and so forth. 
In fact, I thought it might be helpful to highlight the 
fact that we have thousands of these chips on every 
offshore platform. On offshore installations we have 
18 major installations each with 50 to 100 systems 
and each system has probably 100 of those embedded 
chips so in all we have got a couple of thousand 
systems and 10,000 of these chips per location. Most 
of them are fine. Some of them have a date-related 
problem embedded in them and that I think is a 
harder issue to recognise and to realise the 
implications. To come back to what if we had not 
recognised the implications, which was your 
question, it would not have been a safety issue—tt is 
important to stress that in a safety conscious industry 
like ours—in that the embedded systems tend to be 
part of the primary control systems of oil and gas 
facilities and refineries and so forth. You also have 
secondary shutdown systems which in our 
installations are all hard-wired, simple, low 
intelligence and they do not have these type of 
embedded chips. They would essentially shut down 
the installations. You also have a back-up, again for 
example the pressure relief systems on pressure 
vessels. What would have happened had we done 
nothing would tend to be in the area of control 
systems and metering system not working so plants 
would shut down unexpectedly. We would not know 
why they had shut down and so continuity of oil and 
gas supply would be suspended. 
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147. Thank you very much indeed. Just a very 
quick subsidiary question. I imagine—tell me if 1am 
wrong—the problems that your company has had to 
address would be very similar to the problems your 
competing companies, other big majors or indeed 
smaller companies in the oil sector would all have 
had? 

(Mr Brinded) That is correct and indeed we regard 
it as an area more of collaboration than competition 
and as an industry we are trying to tackle it through 
the UK Offshore Operators Association, for 
example. There we have a network of all of the 
operators who are trying to share learning and best 
practice in this area. . 


148. We note from your memorandum that you 
are going to be spending something like £30 or £40 
million on this problem. Will that all be money that 
is “lost” in solving this problem or is some of it 
money you would have spent anyway on IT? Thirdly, 
could you say that as a result of solving this problem 
your IT equipment will be in better shape and 
therefore you will have got some return from the £40 
million of expenditure? 

(Mr Brinded) That is a good question. If I may put 
in context the relationship to our total spend to 
bracket it. As a company we are responsible for a 
spend of £3 billion a year essentially, mostly spent 
with United Kingdom suppliers, so it is a sizable 
operation when you combine upstream and 
downstream and the £30 to £40 million needs to be 
seen in that context. Most of it is likely to be spent 
this year because one of the points I should stress is 
we are trying to get remedial actions completed as far 
as possible by the end of this year. I would say the 
majority of the expenditure (£35 to £40 million is our 
latest total estimate) or nearly £30 million is on the 
asset integrity side and that is investment that we 
would not otherwise have made. It is only in the 
business systems, which together between the 
upstream and downstream come to £5 million or £6 
million, could you say that some of that is 
accelerating new systems that we might have brought 


in anyway. 
149. 90 per cent is money you would not otherwise 


have spent? 
(Mr Brinded) That is correct. 


Dr Turner 


150. Your memorandum tells us that you do not 
think eradicating all the problems by the year 2000 is 
realistic so you aim to reduce the problems to 
manageable levels. What do you mean by 
“manageable levels”? 

(Mr Brinded) Let me try and explain. If we take the 
asset integrity problem again, which I have talked 
about, in the case of the upstream company Shell 
Expro, we have 2,000 systems which contain these 
chips so we have categorised them according to 
criticality. That is one of the things we have been 
doing in the past year—making an inventory and 
deciding which ones are highly critical in terms of 
potential production, control and environmental 
impact if we do not fix them, which ones are medium 
and which ones are of low criticality. We will by the 
end of this year, 1998, have completed the testing, 
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remedial action and re-testing of all the high and 
medium critical ones. Essentially the systems that 
may get left in terms of this will already have been 
classified as low criticality which means that we do 
not expect them to fail, we do not expect them to have 
much impact and if they do we can deal with it after 
the event and they will tend to be in areas of non- 
critical data recording or something of that sort. 
(Mr Thomson) I just wanted to make one point in 
addition to what Malcolm was saying which is that 
throughout the project it is a given that we will match 
the level of assurance that we derive about any given 
piece of equipment or software, whatever, to the level 
of criticality that it poses to the business in the event 
it would fail. Therefore, we are trying to focus the 
resources and efforts where it really matters. Every 
single item that has been identified will be addressed 
in some way. In some situations it might be the 
strategy to take the vendor’s word for compliance in 
cases where criticality is very low. Clearly, where it is 
much higher we want to take much more 
substantial actions. 


151. You are confident then that none of the things 
that are left in your category of low criticality are 
going to have safety or environmental implications? 
You will have tested that? 

(Mr Brinded) We will have tested as far as we can 
and we will be sure that the systems that we have 
classified as low critical are by definition not systems 
that have an environmental or critical production 
impact. 


152. Is the Health and Safety Executive involved in 
oversight of this testing? Is there any independent 
monitoring? 

(Mr Brinded) They are not directly involved in 
monitoring in that sense but actually we are involved 
with the Health and Safety Executive in discussing 
with them and working together to develop the most 
appropriate means of disseminating best practice 
across the industry. 


153. Finally as far as I am concerned, one of the 
predicted problems of the year 2000 is that people 
will stockpile and because they anticipate supply 
breakdowns one of the things they might stockpile is 
obviously fuel. If all our motorists rushed into the 
garage on the last day and topped up their tanks 
would you be able to cope? 

(Mr Brinded) That is an interesting thought. We 
would sell more petrol! I think actually that what 
underlies your question is the balance between 
creating enough sense of urgency to get on with it but 
not creating a sense of impending doom such that the 
public is terribly worried about an issue that maybe 
they do not understand and feel the ramifications are 
going to be much more high impact and catastrophic 
than they will in fact be. If business moves early 
enough and properly then we should not have a 
major problem. In answer to your question directly 
I think we hope to have reassured customers well in 
advance of that date that there will be no problem for 
us maintaining security of supply and therefore 
convince people that there is no need to rush into 
purchasing extra stocks. 


154. You will not do a little stockpiling yourselves 
so youcan replace supplies quickly if they did do this? 
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(Mr Brinded) That might come into our 
contingency planning but it is not something that is 
high on our priority list. 


Mr Beard 


155. Could you say what sort of steps you have had 
to take to put right the very large number of chips 
embedded in systems? 

(Mr Brinded) In essence quite often it is an element 
of going back to the vendor, and I use as an example 
the turbine manufacturer and the control system 
provider, to that turbine manufacturer and seeking 
from them a solution that they are going to have to 
apply to all of their products. That is why the 
problem is not one where we say, “Let’s send the 
Shell specialist out to fix that item” because it is the 
original supplier of that equipment who has to 
actually tackle it and he has to tackle it across all the 
products he supplies. Sometimes we find vendors 
who are fully up to the mark, who recognise the 
problem and who have a very aggressive plan to 
address it worldwide. Other times you find people 
who are only gradually cranking into gear at the 
moment. Can you add to that answer? 

(Mr Thomson) In all of the embedded systems we 
do not have programmatic control so we are forced 
to go to the vendors and we have, of course, close 
working relationships with lots of vendors so they do 
listen. If they are not already on the case they do 
listen when we ask them to set about getting their 
product year 2000 compliant. We are not just 
corresponding. We think the best way to get action 
from vendors is to go and visit them and jointly 
develop a remedial plan relating to our systems. That 
is the first thing to get the technical planning in place. 
The second stage is once they have got a solution, or 
they have demonstrated to us they have a solution or 
they have planned to get a year 2000 version of their 
software, the next thing is to plan the implementation 
of the system and upgrading and testing which 
involves scheduling key people from _ those 
companies on to platforms or whatever at a suitable 
time, preferably when the platform is in shutdown. 

(Mr Brinded) That is quite critical. Some of the 
testing has to be scheduled when you have a planned 
shutdown because otherwise it will itself create a 
shutdown and you do not want to have lots of 
unnecessary interruptions. Again, the earlier you 
start the more you can mitigate the impact by making 
sure that the testing activities coincide with planned 
shutdowns and again with no loss of production. 


156. You say the vendors you have had to deal 
with have had the means of remedying the problem. 
Have there been instances where various suppliers 
have not done much to prepare themselves for it? 

(Mr Brinded) We are still in that stage of 
discovering which systems do not comply and what 
the remedial action programme is they have to put in 
place. That is why our target is to complete the 
remedial action this year. 


157. Are you finding so far that they are in a state 
of reasonable preparedness? 
(Mr Brinded) The full spectrum. 


158. Surprise? 
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(Mr Brinded) The full spectrum I would say, from 
people right on the case seeing it as a source of 
competitive advantage as suppliers of control 
equipment to show how good they are, and at the 
other end people indeed who are only just waking up 
and perhaps not taking as much responsibility for 
products they sold five years ago as you would like 
them to. To amplify we have to deal collectively with 
15,000 suppliers and so the challenge of the supply 
chain management is tremendous. Of those we would 
say around 3,000 are key suppliers from whom we 
would definitely want to seek assurance in some form 
that their products are compliant. Of those, some 500 
would be critical suppliers where we would engage in 
face-to-face dialogue with them to really probe the 
extent and confidence they have in the compliance of 
their products. That may take from a few man-hours 
of joint effort to a few man-weeks of joint effort to 
achieve that assurance. 


159. What happens if they are not in a position to 
give you that assurance? What will be your response 
to it? Some people are going to be black sheep no 
doubt. 

(Mr Brinded) Those are the ones we keep going 
back to and keep going back to. 


160. Do you have any legal power to ensure that it 
is put right? 

(Mr Brinded) I think at this stage we certainly do 
not see it as something that is going to be resolved by 
legal redress and again the consequences of non- 
compliance are usually much greater than the cost of 
remedy so it is important for us to work with the 
suppliers to get them to the point where they will 
remedy it. 


161. When one is talking about compliance does it 
mean reprogramming it in some way, physically 
taking a chip out and putting another one in? 

(Mr Brinded) Usually reprogramming. That is the 
vast majority of what we have done. 

(Mr Thomson) The control system software tends 
to be one of the things that needs to be 
reprogrammed by the vendor but, of course, there 
are layers of this and sometimes the vendors’ 
products are based on products from other sub- 
vendors, if you want to call them that. 


Chairman 


162. What if the chip we are talking about, Mr 
Thomson, is at the bottom of the sea at the end of a 
directional drill? Can you still reprogramme that 
remotely? 

(Mr Thomson) It is possible to replace it with a 
reprogrammed one. 


163. It is replacement rather than reprogramming? 

(Mr Thomson) Where the software is embedded in 
the chip then it is a question of replacing it with a 
compliant one. We have some chips in some weird 
and wonderful places but I am pleased to report at 
least in our case that it seems the more remote the 
chips are geographically and locationally, the less 
likely they are to be non-compliant. Most non- 
compliance occurs higher up/the control pyramid in 
the management information systems and_ the 
monitoring and control systems. The test houses that 
we have used to test equipment for us have 
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discovered from their experience that the low level 
parts of the control pyramid are not very susceptible 
to this. 

Chairman: Have you not broken one of the laws of 
nature? One of the laws of nature says the more 
remote something is the more likely it is to go wrong. 
I know there is a shorthand for it but in this 
Committee I had better not use it! Dr Williams? 


Dr Williams 


164. Briefly, the vendors in this case solve their 
problems for you. You said earlier that some of them 
are quite up to the mark; others are unaware that 
there is a problem. Have some vendors actually come 
to you and said, “With Esso we found this problem 
and we thought we should alert you”? Are some of 
them proactive and should they not become 
increasingly proactive during the course of this year? 

(Mr Brinded) I think some are and we are trying to 
stimulate that. Just as the Government has been 
trying to raise awareness, we have been trying to raise 
awareness across all vendors. We have had, for 
example, days for small and medium sized 
enterprises. We had 500 SMEs in the Aberdeen area 
where this is one of the areas we have talked about to 
stimulate awareness. An increasing number are 
coming to us proactively to say, “We can confirm our 
products are compliant,” or, “We know they are not 
and here are some of the remedial actions we are 
taking.” 


165. Is it not good business practice for them to 
become proactive because the company that comes 
to you during the course of this year pointing out 
necessary work that needs to be done is likely to be in 
the longer term the kind of company you would go 
back to to conduct increased business with? 

(Mr Brinded) That is correct. It is a way of 
demonstrating professionalism and obtaining the 
right reputation. 


166. How do you demonstrate eventually that 
something is 2000 compliant? Is it possible to run a 
simulation or how can you be sure that it will work 
when the critical date comes? 

(Mr Jacobs) 1 can take that one and cover it on 
business information systems. All the business 
information systems that we run are capable of being 
wound forward in terms of time. We can take the 
hardware platform, wind the date forward and then 
proceed with our testing strategies and our testing 
plans. It is of course not just a matter of winding the 
date forward to one single date. There is a range of 
eleven or so dates we have to test for. Which dates are 
tested depends on the process that is being tested. 
Some of these dates run into the year 2001 so some 
testing is slipped over into 1999 rather than 1998 
because of the long-term future of that planning. 

(Mr Brinded) Can I just clarify that point because 
it may not be realised that apart from 1/1/2000 there 


- are other dates that need to be checked. A couple of 


examples, 29 February 2000 being a leap year is often 
not recognised because generally at the turn of the 
century it is not a leap year, only at the turn of a 
millennium it is, and 9/9/99. Those are three of the 
eleven dates we test for. 
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167. Going back to the relationship with your 
vendors, who is bearing the cost of these remedies? Is 
it entirely borne by the vendor or do you share it 
between you? 

(Mr Brinded) It is a mixture I would say. In some 
cases we are certainly bearing the cost. 


168. You are? 
(Mr Brinded) Yes. 


169. What is happening where the vendor has gone 
out of business and no longer exists? What happens 
in this instance? 

(Mr Brinded) That is certainly one of the problem 
areas we are now Starting to tackle. I do not know if 
you have got any anecdotes or insights specifically? 

(Mr Thomson) Yes, we do. We have one case in 
particular that is in the telecoms area where the 
vendor of a particular system no longer exists and the 
company that took them over has ceased to take 
responsibility for products that were made by the 
original vendor and we actually do not have any 
spare instances of this kit so we cannot test it as such 
because we do not have any advice from the vendor 
as to how to do it and we do not have any spares to 
test. It can happen with such equipment that if you 
roll the date forward to the year 2000 you might not 
be able to get it back again. So we are unwilling to do 
this without the support of the vendor. So in this 
instance we are seriously considering replacing the 
kit with something completely different. 


Chairman 


170. Just before we go to Dr Gibson, could I ask a 
supplementary question to something Mr Beard said 
about five minutes ago. He talked about, I think, 
compensation from your suppliers if you had any 
difficulty that you could not overcome by the year 
2000. Move that on a little bit. Do you have any 
insurance policies that would be applicable to third 
parties if something you did or did not do caused 
difficulty to your customers and they came back to 
you as a third party claiming damages or 
compensation? Do you have insurance cover for any 
of this? 

(Mr Brinded) No, not in that specific way. I think 
generally we would aim to meet any such claims 
ourselves, but I think the key is that we aim to avoid 
obviously getting into that situation. We certainly 
hope that by being able to demonstrate to our 
insurers that we have a good plan and we are 
addressing that, that will, for example, avoid our 
having to pay particularly steep premiums on the 
insurance for, for example, our installations, by 
being able to demonstrate that this is a credible plan, 
that we have tackled all aspects, that there is no risk 
to the installation and, thereby avoid having 
escalating premiums. 


Dr Gibson 


171. Why was Shell UK ahead on embedded 
systems of its sister companies for the year 2000 
problem? What was the secret of moving ahead fast, 
because you are obviously in the lead, because we are 
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interested in moving forward other companies who 
are not moving quite fast enough, so we are looking 
for tips from the top? 

(Mr Brinded) I would be hesitant to position us as 
absolutely out in front. I think it is something where, 
as an industry, we are all moving now quite fast. I 
think we started relatively early. We have put quite a 
lot of effort into a compilation of best practice for 
Shell companies around the world and in that sense 
we have issued three documents. This is the latest of 
them. In fact, we could make this available to the 
Committee if you would be interested. This is an 80- 
page compilation of best practice for any of our 
companies around the world, which starts with what 
chief executives and project management must do 
down to the details of how to test the individual 
systems. This is the third such update. Each of them 
has been accompanied by an exhortation from the 
Chairman of the company that this is something of 
prime importance. 


172. It was his idea, was it? 

(Mr Brinded) He certainly signed it. For example, 
I think that this year, at the end of 1997, we asked 
every chief executive of every operating company in 
the Shell group to put in his so-called letter of 
representation, the annual letter to the Chairman of 
the Board, how we have addressed the year 2000 
problem and that we have a plan in place to address 
it. So there is that pressure from the top combined 
with networking across Shell that I think has raised 
the energy right across the company. Can I say also 
that these volumes are the basis of discussion with 
some of the SMEs (small- and medium-sized 
enterprises) that come to us as suppliers and 
essentially say, “We had not realised it was such a big 
problem. How should we address it?” That is where 
we give these reports out, discuss with the SMEs 
what they might do and essentially try and pass on 
some of the learning that we have had. 


Chairman 


173. What would you do if a small company came 
to you, with which you had no connection at all, and 
said, “We hear that you are pretty good at this and 
we are pretty bad. Could we have one of your 
brochures”? 

(Mr Brinded) I think that is something we have not 
yet tackled but we could probably make them 
available to them at cost and I think we could provide 
some degree of advice, but it is an area where we are 
not consultants in this business and our own 
expertise in it is focused on addressing our own 
problems and the supply chain. As I have said, in a 
sense our supply chain is substantial, and so we will 
be getting in one way and another to those 15,000 
companies and to 3,000 of them quite a bit more 
extensively. 


Dr Gibson 


174. So you are not too worried about a company 
from abroad coming to you and asking for their 
problems to be sorted out—for advice—at this stage? 
It is not a priority for you at the moment? It may not 
happen but if it did— 

(Mr Brinded) You mean outside the Shell group? 
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(Mr Brinded) No, I think it would not be a priority 
for us. Some of our staff are available and operate 
occasionally as consultants because it gives them a 
chance to see the problems in other situations, but it 
is certainly peripheral. Our prime interest is resolving 
the issue in our own business in the UK and in 
addition some of the expertise we have is being used 
around the world for other companies in the Shell 
group. Our asset integrity manager, for example, the 
one looking after the embedded software aspects, has 
been out to Malaysia for some time to help the Shell 
company in Malaysia. 


176. Did this come from one person’s head, the 
whole thing? How was it precipitated, this problem 
within your company? Was it two people in a bar 
meeting one night? How does it work? 

(Mr Brinded) J think it has gradually raised its 
profile since early 1996. I would say the third or 
fourth quarter of 1996 was the first time I started to 
become really aware of it, when Mr Thomson and a 
colleague came to us as the technical management of 
the company and said, “This issue is coming. We 
think we should start putting more effort into it.” So 
it tended to come from the experts within the 
company who recognised it was an issue and said, 
“We would like to put more time and resources into 
studying it,” and then the senior management started 
to realise that it was going to be our responsibility 
and something that we needed to get involved in. 


Mr Jones 


177. Could I press you a bit more on the question 
of somebody who comes and knocks on the door 
from somewhere abroad. The Chairman and I were 
in Saudi Arabia just before Christmas and the Saudis 
collared me as a former computer man and asked 
what they should do about the year 2000 problem. I 
rather got the impression they had not started and 
were clearly a long way behind you. If they came to 
you and said, “Can you give us some help, could you 
give us some guidelines?”, as their competitors would 
you show them the door or would you help? 

(Mr Brinded) First of all, I do not see Middle 
Eastern producers particularly as competitors in that 
sense. A Shell company is active in many of them and 
I think where we can see it would be a good idea from 
a business point of view to demonstrate our 
capability and might help in terms of our reputation, 
then we would start putting some time and effort into 
it. That, I have to say, would be more something that 
Shell International would be going for. Really I am 
here representing Shell UK, so all of the operations 
in the United Kingdom. 


Mrs Curtis-Thomas 


178. What are the risks presented by the 
“millennium bug” to your internal supply chain from 
production to retail, and I am thinking specifically of 
not just within the United Kingdom but also where 
you have a European conneetion and association? 

(Mr Brinded) You are particularly talking about 
the delivery of products to the retail end, to the 
petrol stations? 
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1792 Yes? 

(Mr Brinded) I think it is very important indeed to 
think in terms of the supply chain, and when I talked 
earlier about the three aspects—business software, 
asset integrity and commercial integrity—the last one 
is, indeed, this issue of the supply chain, and we are 
taking that very seriously through all facets of our 
business, so on the gas side from the wellhead 
through the gas platform, the pipeline, the on-shore 
terminal and then to the transmission company that 
takes the product, and as well as checking our own 
operation we seek reassurance from those who are in 
that connected supply chain. That _ includes 
particularly in the United Kingdom, for example, the 
gas distribution companies and those who are critical 
to our operation, such as the electricity supply 
companies. We particularly go into them and seek 
reassurance that they have a credible year 2000 plan, 
because it is no good us being in good shape but not 
being able to sell the gas because the gas pipeline 
system is shut down. In the European context, where 
our business is dependent on a supply chain from 
Europe or worldwide, we would seek to follow that 
through the supply chain in the same way. 


180. Could I ask a supplementary question which 
relates to the first question that we asked you, which 
was that the investment is put at £30 to £40 million. 
That is on an investment IT programme, the existing 
programme, of how much? The other piece of 
information I would very much like is that you say 
that the consequences of not taking the remedial 
action is three- to fourfold that sum. How did you 
arrive at that figure and does threefold mean £120 
million? 

(Mr Brinded) Let me try and take them one by one, 
if I may. I may have forgotten them. If I have, please 
correct me. 


181. Existing asset value? 

(Mr Brinded) The existing investment in 
computing systems: in the upstream business we 
spend about £50 to £60 million a year in our IT 
systems and a comparable amount in _ the 
downstream, so one would say around £100 million 
of information technology spend, being a 
combination of new investment and developing new 
applications, buying new hardware and developing 
new systems. 


182. I would like to press you a little. What is the 
total asset value of the new investment? 
(Mr Brinded) Of our total IT portfolio? 


183. Yes. . 
(Mr Brinded) 1 cannot answer that question. I 
could come back in writing on it. 


184. I wondered in fact how you had arrived at this 
three or four-fold consequence arising as a failure to 
implement the remedial programme of £30-40 
million. 

(Mr Brinded) I would say that the reference that we 
made was where we did give an example that the 
estimated spend should not be confused with the 
magnitude of the problem which would be many 
times the remedial outlay, many times. 


185. Many times, not a specific one. 
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(Mr Brinded) No, I do not believe we gave a 
specific number because it is back to your opening 
question, that if we get it wrong and a platform shuts 
down for a month while we fix it, that could be up to 
£1 million a day loss of revenues, so if we had done 
nothing, then as we started with the problem, the 
consequences would have been many times the cost. 


186. I would like a written answer please. 
(Mr Brinded) Yes, that is fine. 


Chairman 


187. You can give us a note on that? 
(Mr Brinded) Yes. 


Mrs Spelman 


188. I have got some questions relating to the UK 
Offshore Operators’ Association of which you are a 
member. How has this Association sought to ensure 
that, as you have referred to in your evidence, the 
“key third parties” address Millennium compliance 
issues? 

(Mr Brinded) The first point is that UKOOA, by 
co-operating as a group of operators, has sought to 
raise awareness with all of the key vendors and 
suppliers, so that there have been conferences 
organised to promote knowledge and to explain best 
practice in conjunction with, for example, Task 
Force 2000. The second aspect would be that we are 
now putting together as the operators a website 
which is available to all of the operators again with 
examples of best practice and looking for some areas 
where we avoid going to the same vendor 35 times, so 
there is some discussion between us as to some of the 
critical vendors, that we should approach them 
collectively. I think the third area raises a point of 
interest which is of some potential significance 
countrywide which is that with some of the key 
utilities and infrastructure providers, like the 
electricity companies, telecommunications 
companies and so forth, there is obviously a danger 
that everybody will be addressing them to say, 
“Please can you assure us of your year 2000 
compliance and what your remedial action plan is”, 
and that is one of the areas where there may be scope 
for finding more efficient ways of tackling that to 
avoid duplication of effort essentially. We have been 
trying to do it on a limited scale between the 
operators within UKOOA. 


Chairman 


189. Can I just interrupt for a second, Mr Brinded? 
What did you mean by a “key third party” when you 
put that in your evidence? 

(Mr Brinded) We meant particularly the 
downstream gas companies and the electricity 
utilities. 

190. Yes, because without a downstream third 
party being compliant, there is no point in your being 
compliant because you are just blocked out. 

(Mr Brinded) Correct, and there is no point in our 
gas plants being compliant if the power source fails, 
and those tend to be shared. 
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Mrs Spelman 


191. It would seem fairly obvious why it is 
important that members of the Association 
approach this in a consistent manner, but are they 
doing so? 

(Mr Brinded) Yes, increasingly we are doing so. As 
I said right at the start, I think we recognise that this 
is not an issue to compete on, but this is an issue 
where collaboration can mean that we all learn 
something from each other and where we can avoid 
duplication of effort by working together. I think 
perhaps Mr Thomson has something to add on this. 

(Mr Thomson) I am the Vice Chairman in fact of 
the UKOOA Year 2000 Committee and have 
attended all the meetings. We are now represented 
by, I would say, almost all, very nearly all 34 
operators who regularly attend the meetings and we 
have just put into being a plan for deliverables and 
actions for 1998. High on that plan is to get all the key 
utilities and suppliers that are of common interest to 
us to come and testify to us in much the same way as 
we are testifying to you here, and we ask questions of 
them and perhaps give them some guidance as to 
what more they can be doing. We believe that this 
will be beneficial to them as well as to us because of 
what Mr Brinded said earlier as we would only have 
to do it once and we could take it from there. 


192. Have the members of the Association been 
able to share all the relevant technical information or 
has such sharing been limited by commercial 
sensitivity or market sensitivity? We are very 
interested in solutions to this, so how have you been 
able overcome that? 

(Mr Brinded) 1 think we are still in the stages of 
actually sharing and within a company the size of 
Shell sharing some of our information internally is 
already a challenge in itself. I think that is why we 
have agreed as an industry to put a website together 
which will facilitate effective sharing where we do not 
push information in every direction, but where you 
can go and search for it, so one of our key projects for 
the first half of this year as UKOOA is to construct 
an efficient and comprehensive website. 


Dr Williams 


193. I would like to ask about staffing and skills 
shortages perhaps that are in the pipeline next year. 
How have you organised the staffing in the way you 
are tackling the problem? 

(Mr Brinded) Perhaps I can start and then my 
colleagues can come in. I think by starting early it has 
given us a certain advantage because I think rates are 
going up and skills are in increasingly short supply. 
We have aimed to get our project team together by a 
mixture of a few of our own experts together with a 
number of consultants. We estimated that we have at 
the moment collectively between the upstream and 
the downstream perhaps 60 full-time people and 
another 20 or so full-time equivalents if you add up 
all the part-time involvement. We try and leverage 
specialist skills. What I mean by that is that where a 
vendor, for example, has to resolve a problem on all 
18 of our major installations, it may be more effective 
for him to conduct a workshop with our own 
instrument technicians from all of those installations 
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and our own technicians who live and work on those 
platforms then go out and do the remedial work. It 
is fairly straightforward, so in that way, rather than 
trying to use that vendor’s individual specialist who 
may be a scarce and costly resource and have him 
visit all 18 offshore installations which would mean, 
with travel, that he was out for probably a couple of 
months, we can use him for a couple of days, maybe 
do one installation with him and then our own people 
can go and use that extra expertise. So that it is quite 
important, to see ways of actually using the limited 
skills available and getting the most benefit out of 
them. 

(Mr Jacobs) I would like to comment on the 
business information systems part of the problem. 
Within downstream, we recognised early on that this 
was nota problem that you could just throw COBOL 
programmers at or a low-level coding-type skill. Part 
of the problem is to fully understand your own 
applications and that means you have to make use of 
existing staff, experienced existing staff, to guide the 
programme of activities towards year 2000 
compliance, so it was important that we did not just 
bring in a team of people working solely on the year 
2000, but that they were integrated into our existing 
support structure, so it is the harmony, if you like, of 
existing skills and knowledge with bringing in outside 
resources to help with some of the coding and some 
of the checking tasks. There is a large range of skills, 
and I have mentioned that coding skills are required, 
but by no means is that the total picture. There are 
analytical skills required for developing solutions 
and there are customer interfacing skills to be able to 
go and talk to the business, develop test plans in 
conjunction with the business and to actuate those 
test plans and the resource which is quite often 
forgotten is that the business itself has to contribute 
to solving the year 2000 problem. It is not purely an 
IT resource issue. We have to look at the business 
resource, what manpower they can make available 
when, so that they can test plans in their own areas. 
So the resourcing issue is not just, as some people 
believe, “Let’s bring some COBOL programmers in 
and the problem is resolved.” It is much greater 
than that. 


194. Mr Thomson, did you want to add anything? 

(Mr Thomson) If I may. In the embedded systems 
we have found a spin-off benefit from our proactive 
approach to trying to broach the problem jointly 
with the vendor, and that is that sometimes they can 
come up with innovative solutions relating to their 
own products, through interaction with ourselves, 
that we would never have thought of on our own. 
Some of those innovative solutions are much less 
labour-intensive to implement than perhaps the most 
obvious way of doing things. There is one case in 
point that we are dealing with at the moment. It has 
still to be ratified that this will work as a solution but 
it looks very hopeful, and if it does, it will cost 
something like a tenth of what we would anticipate 
spending, and, of course, low costs also means less 
use of resources, so they are able to get to more of 
their customers. 


195. Within the staff allécation, the people you 
have, are they mainly existing employees or have you 
recruited extra staff specifically for this programme? 
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(Mr Brinded) Quite a few in the latter category. 
Some needed to have a knowledge of our business 
and our installations but quite a few of the specialist 
project team have been’ brought in as 
contractors/consultants for the duration of the 
project. Do you know the ratio? 

(Mr Thomson) I would guess it to be at the moment 
in Expro, 60 per cent staff, 40 per cent contractors 
numerically. Most of the key positions are held by 
Shell staff. 


196. We were told earlier it is becoming more 
difficult to get those contract staff. How much more 
difficult? Is there a cost factor? 

(Mr Brinded) The rates in the market are up 15 to 
20 per cent over a year ago. 


197. What do you expect over the next year? 

(Mr Brinded) 1 think there will be a market 
response, so more and more people will be brought 
in who have some relevant skills in order to assist in 
the problem. So it is hard to forecast; I would be 
hesitant to do so, to be honest. 


- Chairman 


198. Do you think, Mr Brinded, that the rate might 
begin to go down perhaps in January or February 
next year when the prudent, efficient companies like 
yourselves have done all the work you wish to do a 
year ahead of time and there is less demand for staff 
and there might be more coming back on the market 
at the beginning of next year? 

(Mr Brinded) J think there will be quite a few 
companies who are still getting round to tackling the 
problem this time next year, unfortunately. 


199. Will there not also be some companies that 
might be shedding them? 

(Mr Brinded) Certainly we will be at the peak of 
our use of resources in the first half of this year and 
it will gradually reduce because we want to have 
pretty well completed the programme by this time 
next year, so that if there are any odds and ends left 
we have time to fix them and put in place 
contingency plans. 


Dr Williams 


200. Is there a possibility, then, as your own work 
is gradually behind you, let us say at the end of this 
year, that you will start losing some of your existing 
staff, who will be fairly valuable in the marketplace? 

(Mr Brinded) Yes, I think there is that possibility. 
Most of the staff that we put on to the project we 
brought together because of their knowledge of our 
business, so the Shell staff we have essentially taken 
from elsewhere in the company in order to bring that 
set of skills together, and I imagine that they will 
generally go back to the areas of the business from 
which they have been drawn. Some of them may 
indeed feel that there is a premium to be made for 
another year by being a year 2000 specialist and may 
jump ship to go and earn an extra dollar elsewhere. 


201. Finally, do you think nationally that there is 
a major skill shortage problem here for next year? 
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(Mr Jacobs) On the business information systems 
there are certainly shortages appearing now for some 
of the lesser used languages. In some of the languages 
that were in use in the Seventies and died out through 
the Eighties there is an acute shortage of skills in 
those areas. I liken this side of the project to a bit of a 
voyage of discovery. We are lifting the lid off all these 
applications but there are some there that may not 
have been touched for ten years that have been 
running consistently and efficiently and now we have 
to start lifting the lid off and looking inside, “What is 
this comprised of? What language does it use?” and 
it is during that phase that we were picking up that 
we need some additional skills in this area. There are 
some language skills that are very difficult to get hold 
of. At the moment COBOL resource is not a problem 
but there are other languages that are more difficult. 

(Mr Brinded) And I think it is right to say it may 
also change one’s choice. In certain cases you have a 
choice as to what you do. You can upgrade an 
existing application or you can phase it out and bring 
in a completely new replacement software package 
which would avoid the problem altogether. In a way 
the reason why our business computing problem is a 
relatively small part of the total cost is because we 
have been generally upgrading our business 
applications. For our major finance contracting and 
procurement system we are just in the middle of 
uprating to the so-called SAP system, which is a 
German business system widely used around the 
world. That, because it is year 2000 compliant and 
replaces a huge number of applications that we 
previously had, means that we do not have to work 
on making those year 2000 compliant. So it was 
always in our plans to bring in a new business system, 
such a comprehensive one. It has the spin-off benefit 
that that reduces the amount of upgrade of existing 
applications. The reason for raising this is that I 
think many companies will be faced with that choice, 
and as the rates for remedial action go through the 
roof, it will become more cost-effective to buy a 
replacement application. 


Dr Kumar 


202. You have touched on this, Mr Brinded, but 
you may want to expand on it. What level of support 
have you had from your IT equipment suppliers in 
fixing problems in their systems? 

(Mr Brinded) I think that is one I will hand straight 
over. You are particularly referring, therefore, to 
software? 


203. Yes? 

_(Mr Thomson) It is not one I can answer directly 
because, in terms of our IT equipment suppliers, that 
is an aspect of the Shell worldwide problem that is 
being handled by one of the Shell companies called 
Shell Services International. It isa Shell company but 
it provides computing infrastructural services to 
Shell operating companies around the world. 

(Mr Brinded) So you are talking about the basic 
provision of the hardware and the infrastructure? 


204. Yes? 
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(Mr Thomson) They are handling, on behalf of the 
Shell Group,! liaison with the main suppliers or the 
main names who make computers, operating 
systems, languages, compilers, packages and so on, 
and they are actually finding out, on behalf of the 
Group, the compliance status of those products and 
then they are passing that information on so that we 
can be assured through their efforts that our 
applications are sitting on a compliant base. We are 
not directly involved in this. 

(Mr Brinded) So we are more looking at the 
applications than the substructure, but again my 
understanding is that that programme is following 
the same basic lines of verification. Indeed, for the 
biggest hardware suppliers and operating systems 
suppliers, this is so much meat and drink to them— 
it is their core business—that it tends to be less of an 
issue in getting a positive and proactive response 
from them. It is an area of competitive edge for them. 
Our problems are often more associated—and again 
I come back to the embedded software and 
embedded intelligence—more related to people who 
supply you with a compressor where the control 
system is a small add-on to the compressor yet their 
core business is supplying compressors and control 
systems are secondary, peripheral, and not really an 
area of great competitive edge. If you are dealing 
with a main-frame supplier whose business is main 
business software and applications, they are much 
more responsive generally than the people for whom 
this is something secondary. 


: Mrs Curtis-Thomas 


205. You have mentioned the shortages associated 
with some specific language programmes. However, 
do you believe that the Government has a role to play 
in addressing and alleviating the skills and resources 
shortages associated with your problems and those 
of the industry worldwide? 

(Mr Brinded) I think there are a number of areas 
where it is potentially important to look at how to 
make best use of available resources. I think that 
given the time-frame, the issue of suddenly 
generating thousands more experienced COBOL 
programmers is perhaps one which may not respond 
in time sufficiently. I do think that there are some 
opportunities to try to make more efficient the 
processes of reassurance and in a way we have 
touched on this earlier and perhaps I could expand 
on it. For example, I referred earlier to the fact that 
we have 15,000 suppliers. Three thousand of them 
are rather key to us and 500 are critical and with 
those 500, we want to engage in face-to-face 
discussions. Let me illustrate the 3,000 in the middle 
where we are sending them questionnaires and 
asking them to send written reassurance and details 
of their plans. It is quite possible that those 3,000 are 
getting different types of questionnaires and different 
types of questions from all of their customers. It may 
not yet have started to hit them, but it is beginning to. 
Weare starting to get them from the people whom we 
supply. Now, that process of responding on Monday 
to the questionnaire from Shell and on Tuesday to 
the questionnaire from British Gas or whatever will 


'“Group” means The Royal Dutch/Shell Group of Companies. 
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start to consume potentially quite a lot of resources I 
think there are opportunities to consider looking at 
industry best practice for what is a standard 
questionnaire and I think there is an opportunity for, 
for example, Action 2000 to look at whether we can 
standardise on such a questionnaire, the receipt of 
which should be considered sufficient not for every 
supplier to us, but for that middle category of 3,000. 
I think we would still want some face-to-face 
discussions with the 500 critical ones, but it would 
avoid the diversion of resources into giving 
reassurance everywhere which is quite an inefficient 
use of resources and duplication of effort. So we do 
think that there are potentially some opportunities 
which are more geared to improving the efficiency in 
ways in which resources are used than generating lots 
of additional people with new skills. 


206. Let me get this quite straight then. You are 
suggesting that we somehow, or Action 2000, 
establish a pro forma which would suit the vast 
number of interests of all industry and that we foist 
that on to industry and say, “This is the document 
that you ought to use and it will satisfy 90 per cent of 
all your enquiries”? » 

(Mr Brinded) I do not think it would need to be 
quite as prescriptive as that, but by having one 
document which was relatively standard, then it 
should be the exception that people ask for more. 
They maybe feel entitled to ask for more, but most 
businesses are engaged at both ends of the supply 
chain where you are both a supplier and a customer 
and I think that there is an opportunity to try to look 
to standardise on what is best practice in terms of 
giving a response that demonstrates compliance and 
potentially making that available, for example, 
through a structured website where you could in fact 
search for any company and find its compliance 
statement rather than thousands and millions of 
exchanges of correspondence between people asking 
for your compliance plan, but against a set of 
questions that I have set and then another set of 
questions which someone else has set. I think there 
are some areas for a bit of uniformity and proactivity 
that would save quite a lot of resources. 


207. I would like to come back yet again because I 
quite like the solution, but I do not think it is at all 
practical, quite frankly. Who would you suggest for 
a Start would be fit to put up this standard pro forma? 
Who would be the agents involved in doing that? 
Then you talked about 3,000 suppliers in your 
particular industry. Now, I do not know how many 
businesses there are in UK plc that would be affected 
by this, but how would we disseminate that 
effectively? I do not think you can do it. I recognise 
the implications for industry over this, but I do not 
think there isan easy solution to it which would 
sweep all of that away. 

(Mr Brinded) J certainly do not think it would 
sweep it all away and I was not trying to suggest in 
one bound that there is an easy solution because I 
think we all recognise that this is a tricky one. But I 
would like to believe that in this area of everyone 
seeking reassurance from everyone else, there is some 
room for appropriate bodies to look for some area of 
standardisation to avoid the’ resource use that would 
otherwise prevail. It is certainly something that we 
are investigating to see if it can be done and, as I say, 
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it would not preclude the fact that in a number of 
cases you really will need detailed face-to-face 
reassurance with critical suppliers, and we will still do 
that, but again people can look to co-operate within 
industry to do that as, as we have already alluded to, 
we are doing with the electricity companies and the 
critical utilities, so I think there is an opportunity 
there. 


Dr Kumar 


208. You mentioned in answer to earlier questions 
the skills shortages that the UK were facing. Are you 
facing the same problems with the Shell Group 
worldwide, as such, and, if you are, how are you 
dealing with them? 

(Mr Brinded) 1 think again our focus is on trying 
to leverage the learning that we have as effectively as 
possible, so through the promulgation of the sort of 
books that I have referred to, the best practice 
workshops, to make sure that the approaches are 
relatively standardised and we get the best use of our 
people. There is one aspect which we have also tried 
across the Shell worldwide network again to avoid 
every Shell company approaching the same vendors, 
so that somebody who makes control equipment and 
sells it to 25 Shell companies worldwide will only get 
approached once. There are around 800 critical 
vendors that we have identified which we have 
decided to co-ordinate again so that their 
demonstration of year 2000 compliance is done once 
for Shell and then we consider ourselves satisfied. 


Chairman 


209. You have given us a cost, Mr Brinded, in the 
UK of £30-40 million. What do you think the cost 
might be worldwide for Shell? 

(Mr Brinded) It would be speculation in the sense 
that we run it through every local operating 
company. 


210. Ballpark? 
(Mr Brinded) Ballpark, £200/300 million, of that 
order, I would estimate. 


Dr Kumar 


211. Are you encountering similar sorts of skills 
shortages? That is the question I want to ask. Are you 
facing the same sort of problems or is it different 
elsewhere in the world? 

(Mr Brinded) It is nota question, Dr Kumar, I can 
readily answer, to be quite honest with you. My focus 
is on the operation in the UK. I can certainly 
investigate that and give you a written response. 

Chairman: Thank you very much. That would be 
helpful. 


Mr Jones 


212. A number of witnesses have come before us 
and told us that there are other issues which IT 
departments, particularly, are having to deal with at 
the moment besides the year 2000 problem. Do those 
other demands, such as preparation for the single 
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currency, telephone code changes, things like that, 
have an impact on the progress which can be made 
on the year 2000 and how are you dealing with that? 
(Mr Brinded) They have some impact, but not 
dramatic, particularly because of, as I have already 
touched on, the fact that we were perhaps fortunately 
replacing our main financial packages in, for 
example, the upstream and the chemicals companies 
with SAP and that, therefore, gives us both a year 
2000-compliant solution and a solution that is well 
geared in terms of the euro. Also the aspect which is 
causing us most financial impact and most concern, 
and I come back here to the embedded intelligence 
issue, is not one that is related to those changes, so 
our biggest challenge and, as I suggested at the start, 
perhaps the one which still has not got the profile that 
it needs to have is the one of embedded software and 
the aspects to which you allude do not really impact 
on that. 


213. How far on do you estimate Shell is in 
comparison with other countries, particularly the 
United States, and what about some of the other oil- 
producing countries, such as Iraq? I worked there ten 
years ago and I can remember meeting an oil 
engineer who told me that he was horrified by some 
of the installations where valves were fully open, 
rusted in place, and I just wonder what kind of 
infrastructure they particularly have in now and 
whether countries in less well advanced parts of the 
world perhaps are not quite as well suited to sorting 
out the year 2000 as you are. 

(Mr Brinded) We believe that we are sufficiently 
well placed but that is not to say that we are not going 
to have a single problem. I think it would be simply 
wrong to suggest that. I am sure there will be issues 
we do not address, but I think we are well placed in 
relation to the United States, for example. I do not 
know that we have done an exact benchmark but we 
believe that if we are going with our current plans, we 
are planning for 100 per cent completion of our 
programme by the end of this year. We will probably 
achieve 95 per cent plus but we will still have plenty 
of time to sort it out. Turning to other countries, 
from the Shell group point of view—and we operate 
in 110 countries around the world—where our 
companies are operating we are in perhaps not the 
shape we are in in Shell UK but only a few months 
behind. So we are relatively confident that the 
situation has the focus worldwide. You alluded to 
other countries. Where I suppose there is, of course, 
one alleviating fact is that the more high-tech your 
installations, in a way the more this can be an issue, 
particularly the embedded intelligence. So if I think 
of our operation—and I spent, before coming here, 
five years in the Middle East in Oman—the beam- 
pump operation in parts of it would not be subject to 
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the same challenge. However, there are also some 
high-tech installations in the oil and gas plants there 
which are extremely advanced, and I have no doubt 
they are tackling it in the same way as we are 
tackling it. 

Chairman: Thank you very much indeed, Mr 
Brinded. We have just about come to the end and I 
would like to thank you for your very frank answers, 
and your colleagues Mr Jacobs and Mr Thomson, 
too. It has been an extraordinarily good session for 
us. It is the last of our witness sessions on this 
particular inquiry. Now we get down to writing the 
report. If you would just indulge me for a moment 
before you go, you gave me a nice symmetrical 
number, 9/9/99. Can I give you a symmetrical 
number that you might like to write down: 00111100. 
That is 11 minutes past midnight on | January in the 
year 2000. If you could project yourself to 11 minutes 
past midnight in the year 2000, do you think all the 
street lights will be flickering on and off or will have 
gone out? Do you think aircraft will be circling round 
Heathrow not able to land? Do you think pensions 
and salaries will not be paid or will be paid twice or 
be paid to 3-year-old children? Do you think 
clocking-in machines in factories and industry will 
fail to work and you will not be able to get into work 
or out of it? Do you think burglar alarms will be 
ringing all over the country? Do you think traffic 
lights will be working like they did in The Italian Job 
or do you think life will be normal? 


Dr Gibson 


214. Where will you be? 

(Mr Brinded) I probably will not be in an aircraft, 
No. 1, because I suspect they will not have many 
passengers, so they may choose for commercial 
reasons not to be flying then. I think there is now a 
mood and a pace and a momentum to address the 
issue. I think there is an enormously long way to go 
and we do not have a lot of time, but I believe the will 
is there and that the plans can be laid and the actions 
can be taken in time. So my prediction is, my 
projection would be, that we will pretty well have got 
it okay. We will have spent a lot of money and there 
will be people watching with bated breath, and some 
people exhausted from the remedial actions they 
have been taking right up to the last minute, but I do 
not really see a Doomsday scenario myself. I think we 
can tackle it. 

Chairman: On that note, we will finish this inquiry 
and we thank all three of you very much indeed for 
your assistance. 
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Supplementary Memorandum submitted by Shell UK Limited 


I refer to our oral evidence session during the above inquiry and am writing to provide the Committee with 
the answer to the two outstanding questions to which we promised to reply. I have also provided some 
supplementary evidence to questions by Mr Turner. 


Question 182 


Ms Claire Curtis-Thomas MP: “What is the total asset value of the new investment—of your IT portfolio?” 


It is difficult to assess with complete accuracy the total investment of Shell’s IT asset portfolio in the UK 
because we make capital acquisitions which get written off or become obsolete over an average period of 
around four years. We also make use of IT infrastructure which is actually owned by Shell Services 
International, the organisation which provides Information Technology and Business Services for all the 
Royal Dutch/Shell Group companies around the world. However, we estimate a total of around GBP 115 
million for Shell UK’s IT asset base. 


Question 211 


Dr Ashok Kumar MP: “Are you encountering similar sorts of skills shortages? That is the question I want 
to ask. Are you facing the same sort of problems or is it different elsewhere in the world?” 


As you might expect there are different facets to this question. Computing has increased in such importance 
to the way a business is currently run that the staffing problems which companies are facing have been brought 
about by market demand—in part it is about-suitably trained staff but also about matching their salary 
expectations. 


Shell Services International is currently running a recruitment campaign for high quality specialists in a 
large number of disciplines. They are seeking consultants, senior systems development staff (eg for data 
warehousing, analysts, programmers), client/server systems engineers, telecommunications engineers, 
database administrators and desktop support staff, all of whom are currently difficult to find. As well as 
experienced staff, for some of the jobs they are welcoming applications from recent graduates or final year 
undergraduates from any discipline, as well as experienced IT staff who wish to re-train in a different IT 
discipline. 


Most of these are required for our operations in the UK and The Netherlands, although Shell companies 
in the Far East are also having to recruit in Europe to meet their own IT staffing demands. 


In the UK, with respect to embedded systems, there has been a marked increase in the rates for contract 
staff—approximately 30 per cent over the last six to eight months, with the added problem of the duration 
of their contracts, which are sometimes now very short, one to three months long. 


As Mr Jacobs mentioned in his oral evidence there is also the question of finding people with particular 
skills, for example computer languages which are no longer in use, as well as finding IT people who have a 
knowledge of the particular business sector. Skills shortages also leads to a high level of movement in 
employment by skilled staff, often leaving holes in key teams. 


Supplementary information to Questions 153 and 154 


Mr Desmond Turner MP asked about the ability to supply fuel in case there was panic buying. 


Shell, along with all other oil refining companies within the UK, is required under EC legislation to hold 
at all times 75 days of stocks equivalent to the volume of sales in the previous year. This is termed a 
Compulsory Stocking Obligation and is intended to provide security of supply in the event of any situation 
that would prevent the normal supply of oil feedstocks (crude) and products to the UK. 


In respect of petrol supplies our normal planning process anticipates forthcoming customer requirements 
for both retail and commercial customers. If we were to see demand rising during the months preceding end 
1999 then we would endeavour to manufacture more fuel or possibly import more supplies if this were 
feasible. 


However we should stress that we see Shell’s primary effort going into ensuring that our Year 2000 
programme is carred out in a diligent and systematic manner to reduce potential problems to a manageable 
level and, in the process, reassuring our customers that we are doing everything we can to ensure the 
continuity of supply. We see it as essential to maintain our customers’ confidence and allay their fears over 
this important issue. 


I trust this will provide yoy with sufficient further background for the Committee’s report but please let us 
know if you need any additional information. 
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Memorandum submitted by IBM (UK) Ltd 


1. INTRODUCTION 


IBM is the world’s leading IT (Information Technology) services company and has millions of customers 
in over 160 countries. We have been working with industry associations around the world and with customers 
to raise public, governmental and business awareness of this problem and to find ways to address the issue. 


2. EVIDENCE 


The six issues to which the Committee has invited IBM to respond are set out below. 


(i) the nature, magnitude and implications of an inability to manage the date change in personal and mainframe 
computers, embedded systems and software, especially where such computers are performing safety critical 
operations 


It could be a significant challenge for any individual or organisation using computers. Not only must they 
ensure that all their own hardware and software products, and all their own bespoke applications can cope 
with the date change, they must also ensure that their systems are not contaminated by two-digit dates from 
computers linked to their own by public or private network. Logic chips embedded in process control systems 
such as manufacturing plants and power stations and in devices such as switching systems in the 
telecommunications industry could also be affected. 


If the date change is not handled correctly by the computer system, any computer calculation that involves 
a date eg a credit card transaction or a mortgage calculation could lead to incorrect results. 


Any industrial economy is highly complex in its interdependencies and therefore it is possible that one 
failure in one system could have consequences in many other systems eg up and down the supply chain in the 
distribution industry. 


(ii) the effectiveness of action which has already been taken to avert problems in Government, large corporations 
and small businesses 


The actions taken by large companies have been well documented by research companies such as 
GartnerGroup and IDC. From our own customers we would observe that most large companies have begun 
to take action, but that many of these are in either assessment or planning stages. The two subsequent stages, 
making the changes and testing are expected to take significantly more resource, both technical and 
management. In particular the testing stage is expected to take about 50 per cent of the overall effort and we 
recommend to customers that they plan to have all the changes complete by the end of 1998 so that they can 
have the whole of 1999 for testing. Some large firms are choosing to replace older systems with Year 2000 
ready systems, where possible. 


From our experience of working with our smaller customers, we find that they are less aware and less likely 
to have initiated action. In round figures, we believe from the response to our proactive telephone campaign 
that 50 per cent of small firms are unprepared. Many smaller firms buy IBM products through agents so one 
important action on behalf of these customers, is that IBM ensure that all companies who sell software and 
hardware along with IBM products affirm that these complementary products are Year 2000 ready. We have 
already brought the Year 2000 issue to our partners attention and are now planning to advise these companies 
that in the absence of such an affirmation, joint marketing activities will be stopped. 
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We believe that Government has a particularly significant problem because they rely on a much larger 
proportion of bespoke applications than do commercial organisations. The option to replace may not be 
viable in the case of bespoke applications, now that we have only two years to go to the deadline. Government 
therefore has no choice but to find the resources to fix its applications. We are concerned that Departments 
may in their initial assessments, totalling £370 million, have underestimated the cost of fixing the problem. 


(iii) the role of Government in raising awareness of the potential problems and in seeking solutions, and the 
respective roles Taskforce 2000 and the recently launched Action 2000 


Government has a role, alongside industry and professional associations and the media in raising 
awareness of the problem, particularly among small firms. IBM worked with Taskforce 2000 in its awareness- 
raising activities and we believe that a shift in emphasis to advice and support is timely and important. We 
hope therefore to work with the Action 2000 team as we do with parallel government initiatives in other 
countries. 


(iv) the extent to which new systems and software are “millennium compliant” 


The current models, versions and releases of IBM hardware and system software are Year 2000 ready 
today. In addition, more than 1,900 applications packages are Year 2000 ready. For current information on 
the Year 2000 readiness of all IBM products, customers are encouraged to consult the IBM Internet website: 
http://www.ibm.com/year2000, their IBM sales representative or the freephone IBM Year 2000 Technical 
Support Centre. 


It is possible that some Year 2000 ready IBM hardware may be running non-IBM software that is not Year 
2000 ready and we encourage customers to contact the suppliers of non-IBM products to find information 
about their readiness. 


(v) the development of contingency plans in the event of system and program failures 


As the deadline looms closer, IBM is placing additional emphasis on the importance of contingency 
planning by their customers. IBM offers a business recovery service to customers which is designed to provide 
protection against many forms of system failure. Although, it should be noted that business recovery services 
do not amount to a total solution to the problem, however, we are currently investigating whether this service 
can provide value to customers in the context of failures arising from an inability to deal with the Year 2000 
date change. 


(vi) the legal implications of disputes over liability for compliance costs and system and program failures 


IBM’s position is that liability is defined under contract law. 


3. ANSWERS TO SUPPLEMENTARY QUESTIONS 


In addition to the issues raised by the Committee above, the invitation also sought IBM’s response to four 
specific questions as set out below. 


1. What estimate has your organisation made of the seriousness of the millennium bug problem? 


We see no reason to dispute the GarterGroup estimates of $400 to 600 billion world-wide for a cost figure. 
The Year 2000 challenge is a broad challenge affecting not only the IT industry but virtually all users of 
information technology and electronics. Serious efforts must be undertaken immediately to ensure a smooth 
transition into the next millennium to prevent potential economic and social disruption. 


2. To what extent are the prgducts now supplied by your company “millennium compliant”? To what extent do 
you consider you are responsible for ensuring products supplied in the past are made millennium compliant? 


See (iv) and (vi) above. 
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3. What steps have been taken, or will have been taken, within your organistaion to ensure that your own internal 
systems will not fail at the millennium? How confident are you that you will not encounter problems at the 
millennium? 


IBM shares many of the characteristics of our large global customers. To address our own internal Year 
2000 project, we have established a Year 2000 Project Office jointly managed by our Chief Information Officer 
(CIO) and a Global Services project manager. We are using IBM’s Year 2000 services methodology and are 
currently in the implementation phase of executing that methodology. We are planning to complete our 
project by the end of 1998, leaving a full year for testing. 


4. Do you think that the Government has done enough to raise awareness of the millennium bug and to help and 
identify and apply solutions? What more should be done? 


UK Government has been quicker to take action than some of its counterparts in other European countries 
and we expect the Action 2000 programme to move forward rapidly on raising awareness amongst the most 
vulnerable companies, the small firms, and translating awareness into action through the provision of advice 
and guidance. 


Shareholders and consumers should also be asking companies what they are doing to address the issue. 
24 November 1997 


Examination of Witnesses 


Mr Curis Moore, Manager, Year 2000 Initiative, and Miss CLAIRE Birks, Manager, Corporate Affairs, IBM 


(UK) Ltd, were examined. 


Chairman 


215. Good afternoon Mr Moore, good afternoon 
Miss Birks. Thank you for coming along and helping 
the Select Committee in its inquiry into the 
millennium bug. Mr Moore, would you introduce 
yourself by telling us what you do within your 
company and introduce Miss Birks as well. What we 
will do, unless you tell us otherwise, is direct 
questions to you. If you wish to field some to Miss 
Birks, that is fine and when we get dialogue going we 
will ask her directly. 

(Mr Moore) Thank you, Mr Chairman. I am Chris 
Moore and I am a Regional Manager for the IBM 
global initiative for the year 2000 in Europe. I have 
responsibility for our activities in the United 
Kingdom, Netherlands and Ireland as they relate to 
our customer facing activities rather than our 
internal programme in preparation for the year 2000. 
My colleague Claire is Manager for Corporate 
Affairs for IBM (UK). 


216. Thank you very much indeed. You submitted 
evidence to us in November and you told us in that 
evidence that your large customers were still 
assessing or planning what they should do about the 
year 2000 problem. Can you tell us now to what 
extent your larger customers have made progress and 
are they on target for achieving compliance by the 
end of this year, which I understand most companies 
want to do so they can test it out during the course of 
next year? 

(Mr Moore) Certainly we have seen amongst our 
larger customers a much stronger move towards 
completing the assessment and planning and 
beginning the implementation activity than amongst 
than smaller customers. Most of our larger 
customers are implementing the changes to their 
systems and processes within their company. Many 
have reached the stage of testing elements of that and 
all have stated that they have projects to be prepared 


and that they hope to have completed the 
implementation of the changes by the end of this year 
to allow next year for testing prior to the year 2000. 


217. So it has changed a lot since November when 
it was a rather pessimistic view? 


(Mr Moore) We have certainly seen a change and 
part of the underlying reason for that change is that 
many organisations actually created their budgets 
for the year 2000 implementation work in 1998 
whereas in 1997 they had not actually allocated the 
budgets to begin that work so we have seen an 
increase in the amount of work that has been done. 


218. Shell have told us that quite a few of the 
millennium date problems will manifest themselves 
before the millennium date change over itself. Do 
you agree that is the situation? What sort of things 
could manifest themselves before New Year’s Eve 
of 1999? 


(Mr Moore) They certainly can manifest 
themselves before because we have already seen that. 
There have been some instances of credit cards not 
being processed correctly because they have an 
expiry date beyond the year 2000. Really the issue of 
the year 2000 is not the issue of the calendar event; it 
is the question of whether or not the computer system 
can process a date which is beyond December 31, 
1999 and most organisations are involved in work 
which means they will be handling something that is 
date related beyond December 31, 1999 even now. It 
might be processing a payment stream that goes out 
beyond the year 2000 so it is processing any data with 
dates greater than December 31, 1999. 


Chairman: My son-in-law was delighted when my 
daughter’s credit card would not work any more! But 
I think she has got it put nght. Mr Atkinson? 
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Mr Atkinson 


219. You and your colleagues very kindly invited 
members of this Committee to a briefing dinner just 
before Christmas in which you told us about your 
telephone survey that you have referred to in your 
submission to us. My notes from the dinner meeting 
indicated this survey suggested that there is the same 
awareness today as a year ago, that there is no new 
action, that it is now too late to avoid problems and 
one can only now prioritise. My question is: is that 
situation still true today or have you detected any 
improvement in the extent to which small firms are 
now preparing for the year 2000 since you undertook 
your telephone campaign? 

(Mr Moore) With respect, I do not think I said it is 
too late to take action. 


220. My note, your very words, under the 
heading “Chris” 

(Mr Moore) Thank you! Let me explain, we have in 
the United Kingdom as an example small businesses 
ranging from organisations of ten employees to 1,500 
employees which are customers of ours. There are 
about 6,000 of those. We have either face to face or 
through a mechanism called tele-coverage contacted 
them and spoken to them to understand what level of 
preparedness they have, what level of awareness they 
have and whether they are implementing change. The 
latest review of those figures—and we have shared all 
this data by the way with Action 2000 and given them 
a complete breakdown of what our findings are— 
shows that about 30 or so per cent of those 
companies are telling us they have either prepared 
themselves or have plans in place to be ready. About 
24 per cent are saying that they do not yet want to 
talk to us about the year 2000 and the remainder are 
at some stage in between those two positions, ie, the 
remainder have identified some things they are 
working on but perhaps they need to replace 
hardware or a piece of software but they do not 
necessarily have a full-blown project in place or a 
clear view of when that project will end. 


221. If you suspect that about half of small firms 
are unprepared can you go a little further in 
describing to us what you mean by unprepared? 

(Mr Moore) Yes. If you consider the ways in which 
the year 2000 issue can impact, it can impact on a 
computer system, and it can impact on the computer 
system of a supplier company, it can impact on the 
infrastructure that supports a business including 
uninterrupted power supplies, lifts, elevators, air- 
conditioning, all that kind of thing. So if you are 
preparing for the year 2000 you really need to have a 
project that ensures the computer systems have been 
checked, that your supply chain is not going to be 
affected, and that the basic infrastructure of your 
business is not going to be affected. We are seeing a 
number of companies that have projects that focus 
primarily on just the IT systems rather than all of the 
aspects of the year 2000 and we are seeing companies 
that perhaps have focused on one element of their IT 
system. Maybe they have a major system but perhaps 
have not yet focused on PCs or subsidiary systems 
scattered around various parts of the company. 
When we are saying that companies may not be 
preparing we are saying it is across the broad 
spectrum of everything they have to prepare for. Part 
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of the activities we are involved in is advising our 
customers on what they need to do with regard to 
IBM products and IBM systems they may be 
working with but also broader aspects of the year 
2000 problem. 


222. Obviously small- and medium-sized firms are 
unlikely to have the technical skills in-house to take 
the actions necessary. They may find it costly—we all 
know it is growing—to buy in the expertise. Is it 
possible to develop a best practice which can rely on 
non-technical skills to respond to this problem to 
beat the bug without the assistance of experts? 

(Mr Moore) I think there is a lot of scope to 
develop best practice advice and guidance. 


223. There would be panic if they left it to the 
last minute? 

(Mr Moore) The suppliers would have trouble 
reacting to that simultaneously. If the software is 
being written in-house the expertise and knowledge 
about that software resides with the people who 
wrote it. Whether or not an external supplier can 
come in and assist depends very much on exactly how 
that has been written and structured and what 
information can be made available. Certainly 
organisations like IBM and many others will go in 
and help a company with software that they have 
written themselves. 


Dr Jones 


224. The implication of what you have just said is 
suppliers are waiting for people to approach them 
before they respond to their queries. I would be 
worried if that is the case. What action is Action 2000 
taking on this? 

(Mr Moore) It is certainly not the case that 
suppliers are waiting. As I mentioned earlier, we have 
just finished contacting 6,000 small- and medium- 
sized businesses and that is a proactive activity to 
alert them to the fact that year 2000 is coming and 
what it means. It gives information about products 
they may have bought from us in the past and the 
services we offer now. We are not alone in doing this. 
We wrote to 750,000 customers world wide twice last 
year to advise them about this and we ran free 
seminars in every country, eight in the United 
Kingdom, to alert people to the fact that is 
happening and again to alert them to information 
about our product and the services we can provide. 
So we are absolutely not waiting for customers to 
come to us. We are doing everything we can to raise 
this issue. I am sorry, but you had a second part to 
that question. 


225. What do you know that Action 2000 are 
doing on this idea of best practice? 

(Mr Moore) Probably a little more than the public 
would know from the press, but from some 
discussions with members of Action 2000, Iam aware 
that they have looked at how they can best 
promulgate best practice, how they can provide 
advice and guidance to small businesses and that they 
have a number of initiatives in hand to try and do 
that. 
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Dr Gibson 


226. I wanted to turn to supply chains. I believe 
that some of your products are “bundled”, a current 
phrase, with other products. What level of success 
have you had in ensuring that those products are 
millennium-compliant and compliant with yours 
when they are bundled together through an agent 
and they are distributed? 

(Mr Moore) There are two parts to that. Every 
computer system is a collection of components that 
have usually multiple suppliers to build up the 
system. At one end of the scale, they are the very 
sophisticated, large systems that are built as part of a 
service contract from a supplier like IBM, and at the 
other end of the scale, they are the domestic PCs that 
home-users use that are also bundled. Do you want 
me to address the whole spectrum? 


227. Is there a difference in the success rate with 
both and does the story come out the same? When 
your products are bundled with others, at either end 
of the scale, what happens? 

(Mr Moore) lam not sure of the success rate. Iam 
not really sure I understand the question. Our 
responsibility, where we are providing a system, is to 
understand the specification that the customer 
requires for that system, to identify the right 
components to build the system from and to work 
with the suppliers of those components to integrate 
them together. 


228. So there will be non-IBM products there as 
well? 
(Mr Moore) Yes. 


229. Suppose they are not up to the standard you 
would expect in terms of the millennium problem? 
What do you do then? Do you break off relations 
with them or what? 

(Mr Moore) We would identify to the customer, 
who often will have specified a particular component 
they would want us to use, an IBM software package 
or something like that, and we would notify to the 
customer and to the supplying organisation our 
concerns about that and work it out with them as to 
what the best thing to do is. 


230. But would you go to the point of breaking off 
the relationship with them? Has that happened? 

(Mr Moore) I think that is addressing another 
aspect of how we deal with our business partners 
where we are marketing systems with business 
partners. 


Chairman 


231. Can I just put a supplementary to Dr Gibson’s 
question? If you have got product A which is yours 
and is millennium-compliant, and product B is 
bundled with it from somebody else which is not 
millennium-compliant, is the chain only as strong as 
its weakest link and if its weakest link is not 
compliant on product B, the whole thing is non- 
compliant, is it? 

(Mr Moore) That can be the case, yes. 

232. Therefore, there is not much point in buying 


something, half of which is IBM and is millennium- 
compliant if the thing bundled to it is non-compliant? 
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(Mr Moore) I could not agree more, but that is 
precisely what we do not do. From our business 
partners, we have worked with our business partners 
who typically are distributors and resellers of our 
equipment and they would bundle, for example, their 
applications software and PC hardware and sell it as 
what we would term a “solution” into the 
marketplace. We have worked with them to identify 
through them which of their software packages or 
solutions are year 2000-compliant and where they 
have identified that they are year 2000-compliant, we 
have helped with them build a database of all those 
solutions, so that everybody in the market knows 
what is compliant and we maintain our marketing 
relationship with them. Where they are unable to tell 
us that their software solutions are year 2000-ready 
and will, therefore, work with our year 2000-ready 
hardware and systems software, then we have ceased 
that marketing relationship. 


233. Miss Birks, I think you were going to add 
something. 
(Miss Birks) That was exactly it. 


Dr Gibson 


234. You describe it as a heavy-handed approach, 
would you? 

(Mr Moore) We have actually not found it heavy- 
handed. We have found they are actually very eager 
to collaborate. It is in their interests, it is in 
everybody’s interests to sell year 2000-ready systems, 
everybody’s interest, so there is no reluctance to 
identify what is year 2000-ready and what is not and 
they understand why we want to have as our business 
partners people who are providing year 2000-ready 
solutions. 


© 


235. Let me quote you this: “...there is sufficient 
evidence from the research...that no one can be 
confident in any PC system being compliant which is 
currently on the market”. How do you react to that? 
Is that nonsense or is it true? 

(Mr Moore) No. 


236. It is nonsense? 

(Mr Moore) We have repeatedly stated which of 
our PCs are year 2000-ready and which are not and I 
think as a result of that particular statement, Dixons, 
who are one of our major resellers, took an 
advertisement with all of their suppliers to reconfirm 
that they were satisfied that we had provided them 
with year 2000-ready products to resell. 


Mr Beard 


237. When you are asked to amend equipment 
retrospectively for someone who has bought it 
previously, do you actually charge for it or is it part 
of your service? 

(Mr Moore) To amend equipment? 


238. Yes. 

(Mr Moore) There are several aspects to that. It is 
common practice in the computer industry and the 
computer marketplace at large that suppliers create 
products and then they produce upgrades for those 
products or new versions or new releases, so every 
supplier is constantly asking its marketplace to 


62 MINUTES OF EVIDENCE TAKEN BEFORE 


4 February 1998 ] 


[Mr Beard Cont] 

upgrade to the next release of software or the next 
version of software or a new model of the machine. 
That is normal marketing practice and accepted in 
the customer base and we charge for upgrades. We 
have been producing year 2000-ready versions of our 
product line for some time now as upgrades in that 
sequence of upgrading activity and yes, we charge 
for those. 


239. And that is universal with every piece of 
equipment, every product you have sold and you 
would treat the millennium-compliant version of it as 
a new product and you will charge for it? 

(Mr Moore) Well, we would actually turn it 
around the other way. We have had an ongoing 
programme of refreshing our product line and as part 
of that refreshment, we have created upgrades that 
are year 2000-ready. 


Chairman 


240. What is the earliest date that your equipment 
was sold that did not need refreshing as far as 
millennium compliance was concerned? 

(Mr Moore) I actually could not answer that 
question. 


241. Well, if I had bought something from you in 
1996, would I expect to have to spend more money to 
have it upgraded for computer compliance? 

(Mr Moore) If you take the examples of PCs, we 
have said that everything sold from the beginning of 
1996 was year 2000-ready and amongst other 
products we have had year 2000-ready versions of 
those products available since the beginning of the 
1990s/end of the 1980s in some instances and they 
have been on the market not sold as year 2000-ready, 
but they simply have the year 2000 capacity built 
into them. 


242. If, by chance, I had bought something from 
you in 1997 and found that it was not millennium- 
compliant, would you put that right for me without 
charging? 

(Mr Moore) If there is a chargeable upgrade that 
we would ask you to move into, we would charge you 
for the upgrade. 


243. But if_it is chargeable, by definition, you 
would charge me. That is not what I am asking. If I 
bought something in 1997 and I found that it was not 
millennium-compliant, would you admit that it 
should be and, therefore, put it right for me free of 
charge? 

(Mr Moore) There are very few instances of that, 
but where it has occurred and there is a millennium- 
ready version available from IBM, we would ask the 
customer to upgrade to twat version. We would 
almost certainly charge for that unless there were 
special circumstances and then we would discuss it 
with the customer. 
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Dr Gibson 


244. How would your customer know though? If I 
have gone into a shop on a Saturday and bought 
something for my kids, how would I know? 

(Mr Moore) Because we have gone through an 
exercise of contacting every customer that we can 
contact. We have literally searched our entire billing 
systems and identified every customer we have sold 
something to and gone through an exercise of 
informing those customers where we believe those 
products are not ready. There is also for any 
customer who may not have been contacted by us for 
whatever reason a facility on the Internet that they 
can now access and, with whatever product name or 
number they enter, it will tell the customer whether 
or not that product is year 2000-ready and, if not, 
what the replacement product is. 


245. How many have replied to you roughly? 
(Mr Moore) How many have searched the 


Internet? 


246. Well, how many have come back to you and 
said, “You have done me”? 

(Mr Moore) To the best of my knowledge at this 
time, none. 


247. Really? Do you not find that amazing? 

(Mr Moore) Well, as I said, it is common practice 
and accepted practice in the industry that customers 
move through a series of upgrades and migrations 
and we have been encouraging customers to do this 
for some years and we have been introducing year 
2000-ready versions of products for some time, so 
actually many of our customers are already on year 
2000-ready versions of products. Where they are not, 
we are now identifying to them that in some instances 
they may be on products that are two or three 
generations old. 


Mr Beard 


248. When you have contacted them, you have 
actually actively said, “You will need to amend the 
version you have got by buying this version”? 

(Mr Moore) Correct. 


249. And how many people have taken that option 
up? How many have ignored the advice, as far as you 
are concerned? 

(Mr Moore) I cannot tell you that yet. We are still 
going back over all of the people who have— 


Chairman 


250. Come on, give us ball-park figures otherwise 
we are wasting our time. 

(Mr Moore) lam sorry, Chairman, I cannot even 
give a ball-park figure. We finished contacting all of 
our large account customers at the end of last year. 
We finished the tele-coverage survey I mentioned of 
6,000 small businesses in the United Kingdom at the 
end of last year. We are now in the process of re- 
visiting those to say this is the migration plan we 
recommend, these are the replacements we 
recommend. In many cases there are other 
alternatives to IBM products they could select so 
customers, quite naturally, are actually making a 
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judgement now as to whether or not they want to 
upgrade to an IBM product or buy another product. 
I am afraid I simply do not have the figures. 


Dr Jones 


251. Do you supply components to other 
companies who assemble them into different 
products that have different brand names at all? 

(Mr Moore) We do supply some components, yes. 


252. How do these customers fit into all this? They 
will see they have got a machine that has got IBM 
parts in it. 

(Mr Moore) The division of IBM responsible for 
the manufacture and sale of those component parts 
works with the companies who supply those 
component parts to identify whether or not there are 
any issues of those component parts and then it is the 
supplier of the finished system that knows their 
customer base. 


253. Are they doing the same as you, do you know? 

(Mr Moore) I could not actually tell you. We 
would advise them to do the same and we give them 
advice on what the components are. 


Dr Gibson 


254. There is a whole mysterious area of 
thousands, or millions perhaps, who are going to be 
shocked, stunned on the dreadful night. Is that a 
possibility? Is that what you are saying to us? 

(Mr Moore) That is not what I am saying to you 
because even with our machines like PCs we buy 
components from other suppliers, we do not 
manufacturer every component that goes into an 
IBM PC. We will work with them to understand 
whether or not the components are ready. 
Ultimately, we are the manufacturer of that system 
so we through our distribution outlets, our own sales 
force and so on will disseminate information about 
our products that we have built out of other people’s 
components. Put us in the other position where we 
are a component supplier, we advise that 
manufacturer of any concerns that we may have. 
They ultimately have to do a similar thing to what we 
are doing and contact their customer base and 
provide information about the finished system. 


Mr Beard 


255. You have spoken as though all the corrections 
that are required can be done through updating the 
software versions, if I have understood you correctly. 

(Mr Moore) Then I have misled you. The 
conversation has focused very much on supplied 
products up until now and a very very significant 
proportion of the challenge or problem is the amount 
of what we would call bespoke code application 
software, programming language software that has 
been written by the end user of the product we 
provide to them and that presents a very very 
significant challenge to process that code find 
instances of data occurrence that might cause a 
problem, make the change and then test that. 


256. Taking that aspect of it, how are you dealing 
with customers from the past? 
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(Mr Moore) We have not written that code. The 
customers have written that code and most of our 
large customers have very significant information 
technology divisions with hundreds, possibly 
thousands, of employers including programmers 
who would have written all those software 
applications they use in house. What we offer to 
those customers who might have bought systems or 
hardware is services to assist them with processing 
their application code to identify the problems and 
change it. We have 22 conversion centres worldwide 
where we can do conversion on Cobol, PL1. 


257. Those are programmes they have written? 
(Mr Moore) Right. 


258. Are there no instances of systems with 
programmes which you have been responsible for 
which need attention? 

(Mr Moore) Yes. 


259. What do you do with those cases? 

(Mr Moore) Where that is the case we have to go 
back to the customer and with them review the 
original specification which may have been modified 
since we did that. That is often the case and we may 
or may not have done the modifications. We work 
with the customer to identify what needs to be done 
to make that year 2000 ready and agree with the 
customer the commercial basis for whatever work 
we do. 


260. So there are three categories you are referring 
to now. One is where the customers can do it by way 
of a normal commercial transaction by upgrading 
the system or software. Another is where the code has 
been written by them and you will help them. And the 
third is where the code has been written by you and 
you discuss it with them. Who pays in the latter case? 

(Mr Moore) That depends entirely on the form of 
contract between us and what modifications may 
have been made subsequently. Each one is almost a 
unique situation. 


261. Do you have any instances of embedded 
systems in industrial control equipment that you 
have to deal with? 

(Mr Moore) No. Typically the components which 
people are concerned about with embedded systems 
would be process control and plant control 
equipment. Those are not pieces of equipment that 
IBM manufactures. 


262. That does not apply to you? 

(Mr Moore) We do try and help customers 
understand how to run a project to assess and 
evaluate the risk from embedded technology. Again 
we provide services in that form. We do not have the 
manufacturing or technical expertise with the actual 
embedded technology as such. 


263. The two aspects where you are helping people 
change their own code or going back to provide the 
information to amend it takes certain skills. Are you 
experiencing any skill shortages in those activities? 

(Mr Moore) There has been a lot of discussion in 
the press about skills shortages particularly in the 
area of programming languages. Certainly we are 
seeing a growing shortage for some languages. We 
can still find people but they are harder to find and 
are more expensive. Perhaps something that is not 
commented on very much is the need for very 
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experienced project managers and program 
managers as we would call them for what are fairly 
complex projects. Also system architects. If you are 
making changes to hardware, to systems software, to 
applications software, to your network, ultimately 
this is a change to the architecture of the total 
computer system and that requires high level 
expertise to advise on where to make changes and 
how to make them. There is probably a greater 
shortage of experienced project managers and 
systems architects than programmers right now, and 
clearly there is going to be a growing shortage. 


264. And how soon is that going to be felt? 

(Mr Moore) lhonestly do not know how to predict 
that. There are a number of other elements that come 
into play here. IBM is a member of EURIM (?) and 
perhaps, Claire, you would like to comment on that. 

(Miss Birks) IBM is a member of EURIM and we 
have worked with them to _ produce a 
recommendation to governments that they review 
forward programmes of legislation so that they can 
avoid introducing legislation which will demand 
extensive IT changes at the same time as 
organisations, including government organisations, 
are having to modify their systems to cope with year 
2000 and the euro because we are concerned that with 
the layering of extra demands for IT change on to the 
basic year 2000 and euro changes is a high risk thing 
to do. 


265. What is IBM doing about that? 
(Miss Birks) We are lobbying through industry 
associations like EURIM. 


Mr Atkinson 


266. May I ask on this point whether you regard 
the Data Protection Bill that has just come before the 
other place as being one such piece of legislation 
which one could have avoided to reduce the 
problems? 

(Miss Birks) The Data Protection Bill will provide 
some very valuable protection to the individual but, 
yes, I think at some stage— 


267. It has IT consequences you could do without 
at this time? 
(Miss Birks) Yes. 


Mr Beard 


268. Could I go back to the question of skills 
shortages. You said it has not happened yet but in 
certain categories like project leaders it may well do. 
I did not quite catch your answer when I asked how 
soon is that shortage likely to arise. 

(Mr Moore) The reason why I hesitate to answer 
is because we still do not have a clear view of what is 
happening in the market place. Perhaps I can explain. 
The larger customers who have a very significant 
proportion of application software they have written 
in house they have two options. One is to use internal 
resources to make changes to that software and 
prepare it for the year 2000 or they can bring in extra 
resources to do that and juse their own internal 
resources on other projects. The extent to which they 
come to the market or use their own internal 
resources to do it will affect greatly the level of skills 
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in the market place. It depends whether or not 
customers displace their current planned IT activity 
resources towards the year 2000 or not. What we are 
beginning to see is a great displacement of internal 
projects that are being put to one side in order to 
focus on year 2000 which means they are using 
internal resource to do that and not coming to the 
market for that resource. However, if that changes 
then it will accelerate the rate at which the shortage 
will build. We cannot predict that at this time. 


269. What about the sort of activity you are 
responsible for where you are amending your own 
equipment or helping people—are you experiencing 
a shortage of people to do that? 

(Mr Moore) No. To date, we have been able to find 
the resources we need to provide the services to our 
customers. 


270. Do you anticipate the resources to become 
short in the near future? 
(Mr Moore) Yes. 


271. When? 

(Mr Moore) We do not know. We build a forecast 
that looks two or three months out which we have 
some confidence in and then we can look twelve 
months out, so we try and do a resource requirement 
plan three, twelve and 18 months out. We look at that 
plan and revise it every three months and, honestly, 
all I can tell you right now is that in the short term 
we can see the resources we need, but every time you 
refresh it, you get greater confidence about what the 
outer months are going to look like. We do not know 
yet when the shortage will come. 


272. Lastly, in a company like yours where you do 
not manufacture everything and you outsource a lot 
of things, are you having difficulty getting 
compliance from your outsourcing organisations? 

(Mr Moore) No, the answer to that is no, we have 
no difficulty. Well, we have reviewed with all of our 
suppliers the services and goods they provide to us 
and review with them whether or not there is a year 
2000 problem. We have had no reluctance from any 
supplier in telling us what the status of their products 
and services is and we have not identified at this stage 
any major risk areas. 


273. What about those you received in the past, 
things that have been outsourced ten or 15 year ago 
which are now part of your liability? 

(Mr Moore) What are you referring to there— 
where we might have bought it— 


274. Where you bought something in from, say, 
Taiwan and it has an IBM label on it, but the liability 
to make it compliant is with the original supplier. 

(Mr Moore) That would be part of our assessment 
of whether a product that IBM has sold is year 2000- 
ready or not, so we would have reviewed all of that. 


275. So you deem it as your own? 
(Mr Moore) Yes. 


Dr Jones 


276. Just on this question of skills: in your 
assessment do you take into account some of the 
companies that may have actually been millennium- 
ready, and we were talking to Shell last week, and 
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that there may be resources released from those 
sources because they will be ready in advance of the 
year 2000? 

(Mr Moore) Certainly there is the opportunity, if a 
company has completed their project, for those 
resources to become available in the market. I think 
there is a bigger opportunity which is where a 
company or an organisation has been through the 
entire process, including testing, and there is a lot of 
information there that can be shared to help improve 
best practice with lessons learned and that is the 
biggest opportunity. Certainly skill resources can be 
recycled. There are, to my knowledge, not that many 
organisations that have completed it and completed 
testing and are now releasing resources back into the 
marketplace. 


277. Will they need some incentive to do that? Do 
you think that companies will see that they have 
something to offer and will voluntarily do this, or will 
there need to be some incentive for them to do so? 

(Mr Moore) Where they are highly skilled and 
knowledgeable members of the internal 
organisation, the internal resources of a company, 
then I would imagine that they would be quite 
reluctant to release those into the marketplace. 
Where they are contract staff who have been brought 
in, they would be probably delighted to release them 
because they are very expensive and will not want to 
keep them on for longer. 


278. Does IBM have limitations on the age of 
systems for which you are willing to offer year 2000 
assistance? I am thinking particularly of software in 
some systems where the hardware is not in existence 
any more and they are running off software 
emulators, and that probably means more to you 
than to me? Is there any issue there? 

(Mr Moore) We will help any customer where we 
can understand how to help them either by replacing 
hardware or systems software or helping them to 
rewrite applications software. If we cannot see how it 
can work, we will advise them so and in those cases 
it may mean the wholesale replacement of the entire 
system. 


279. The Civil Aviation Authority and the 
National Air Traffic Control Service have told us 
that they are content that their year 2000 project is 
making satisfactory progress. What was the basis 
then of IBM’s recently-reported claims that the 
National Air Traffic Control Service would not be 
ready for the year 2000? 

(Mr Moore) There was no basis in the sense that we 
never made that claim. What we have done and we 
have done this with all of our customers, as I 
explained earlier, is to contact our customers to tell 
them what products they have from IBM that we 
would regard as not ready for the year 2000. The case 
of the Civil Aviation Authority is a very unique 
situation. They use an old IBM product called a 43- 
81 which is a mainframe. The model of 43-81 they 
have we have declared as not ready for the year 2000 
because it cannot run the year 2000-ready versions of 
our systems software. Now, the vast majority of all 
the users of 43-81 use IBM systems software, so we 
have said that they need to replace the hardware in 
_ order to move to year 2000-ready versions of our 
systems software. In the case of the Civil Aviation 
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Authority, they did not use our systems software; 
they used their own bespoke systems software and 
what we have done is provided them with technical 
information so that they can evaluate whether or not 
their systems software running on our 43-81 actually 
is year 2000-ready and that is what they have 
commented on in their response which says that with 
their project which has been running since 1996, they 
are confident they can provide year 2000-ready 
systems. 


280. You have no reason to believe that their 
system is not adequate? 

(Mr Moore) We are not directly involved in that 
sense. We provided them with the technical 
information so that they could make that evaluation. 


Chairman 


281. Did you see the press reports that quoted your 
company as saying that the National Air Traffic 
Control Service would not be ready for the year 
2000? 

(Mr Moore) 1 did see those, but we did not say that. 
We said— 


282. You saw the reports. Therefore, did you take 
steps to correct those reports in the press which were 
a slur on the National Air Traffic Control Service and 
which were the basis of agitation to the population 
at large? 

(Mr Moore) We discussed it with the National Air 
Traffic Control Service and _ following that 
discussion, there was the letter published by the 
Director of IT Services in The Daily Telegraph and 
that was the agreed reaction. 


Dr Kumar 


283. My question is regarding domestic users. To 
what extent will domestic PC users be exposed to the 
year 2000 problems and what sort of support are 
IBM providing to PC users when they turn to you 
for help? 

(Miss Birks) As Chris said earlier, even the humble 
home PC is a system with five or six components 
which may well come from more than one supplier 
and relatively few home PCs in the UK incorporate 
IBM hardware or software products. We trade 
through channels and through business partners and 
we have been working with those business partners to 
make sure that the proper support is provided. 
Domestic users are entitled to call a Freefone number 
for help or to access the information that is available 
on the Internet to find out what products are ready 
or not ready. 


Dr Williams 


284. Can I ask you, are you involved with the 
Government’s Action 2000? 

(Mr Moore) Yes. 

(Miss Birks) Yes. We were involved with Task 
Force 2000 and we are supporting Action 2000. 
Indeed we have seconded one of our year 2000 
experts to Action 2000 for four days a week to 
provide them with additional industry expertise on 
the topic. 
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285. What is your assessment of the Government’s 
strategy in relation to this? Is it enough and is it well 
directed? 

(Miss Birks) I think that Action 2000 has yet to 
draw up full plans of all the actions it wants to take, 
but indeed in having a blend of awareness and advice 
and guidance activity, Iam sure that that is the right 
way to encourage businesses and other organisations 
to address the problem. 


286. I think it has been quite heavily criticised for 
not doing enough and understating the problem. Is 
that your assessment, that it should be doing much 
more? 

(Miss Birks) I think this is one of those areas where 
many organisations are responsible for taking 
action. IBM and the other suppliers in the IT 
industry have all been taking action with their 
customers so any additional action that Action 2000 
can take is a welcome reinforcement of that activity 
that is already going on. 


287. Mr 
responsibility? 
(Mr Moore) I have for a region of Europe. 


Moore, do you have European 


288. How do we compare with Germany, France 
and other members of the European Community? 

(Mr Moore) In many senses very well. As an 
example I was contacted this week by an 
organisation in Germany which were interested to 
know how Action 2000 and Task Force 2000 had 
come into being because they would like to 
encourage the German government to do the same 
thing. In many instances you will find that the UK is 
ahead of other countries in Europe in developing 
support programmes for small businesses and 
developing awareness. It differs in scale and I am not 
sure that there is a right or wrong there. In the United 
Kingdom there is such a lot of supplier activity, very 
strong trade associations (the CSSA and the FEI) 
which are all very active. In many countries the 
suppliers are not so active and the trade associations 
are not so active so there is more emphasis on 
government sponsored organisation. Certainly 
compared to other European countries the UK has 
taken action. 
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Dr Turner 


289. IBM have told us that the Government has 
under-estimated the cost of the programme to 
government departments. What is your basis for 
saying the Government has under-estimated the cost 
and have you put a figure on the cost to government 
departments? Have you got an estimate? 

(Miss Birks) Relatively few government 
organisations are IBM customers in the UK, so we 
have no information beyond that which has been 
published about the way that the current estimates 
have been developed, but in making that comment 
that we are concerned that they may be too low we 
are extrapolating from our experience with our 
private sector customers which shows that the 
estimates they make early in their year 2000 
programmes about the likely cost of fixing the 
problem are often significant underestimates it turns 
out later on in the programme. That is the basis for 
our comment. 


290. Do you think that we need more 
collaboration, more dialogue between public 
authorities both here and in the European Union 
about the cumulative and timing impacts on IT 
systems of proposed legislative and regulatory 
actions? 

(Miss Birks) | am sure that would be helpful and 
the European Commission has already been taking 
some action to gather government and industry 
organisations together to work out what plan it can 
best have to help. 


Chairman 


291. Thank you very much indeed. We have 
finished very close to time. We have another session 
to follow. May I thank you, Mr Moore, for taking 
the burden of the day and also you, Miss Birks, for 
coming along and supporting so well and thank you 
for your help to this Committee in the inquiry it is 
undertaking with a degree of urgency bearing in 
mind that we have 22 months left or thereabouts. 

(Mr Moore) Thank you for the opportunity. 


Memorandum submitted by the Federation of Small Businesses 


INTRODUCTION 


1.1 The Federation of Small Businesses was founded in 1974 and is the major organisation in the UK and 
Europe representing the intgrests of the self-employed and those who direct small businesses in the UK. It is 
non-profit making and non party-political. A membership in excess of 100,000 benefits from the nation-wide 
lobbying force committed to furthering the interests of the self-employed and owners and directors of small 


businesses. 
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SUMMARY 


2.1 The FSB believes that there is a problem which needs addressing but co-ordination between 
Government, Public Authorities and large and small businesses should lead to a satisfactory resolution. 


ISSUES IDENTIFIED AS TERMS OF REFERENCE 


3.1 Issues 


“The nature, magnitude and implications of an inability to manage the date change in personal and 
mainframe computers, embedded systems and software, especially where such computers are performing 
safety critical operations”. 


3.2 FSB Comment 


Risk managers need to approach the Year 2000 issue like any other program, but with a new degree of 
vigilance. Most importantly, they must recognise that it is not just a technical data conversion problem that 
the Chief Information Officer and IT department have undertaken. It is here now. Year 2000 compliance is 
a company wide issue that impacts every level of a company’s management, internal and external operations, 
contractual relationships, insurance programs, risk financing plans, employee benefits, safety and loss control 
programs, vendor agreements, suppliers, software and computer systems. 


Evidence is slowly emerging that certain embedded chips will cause shut down of plants such as The BP 
refinery, Grangemouth. These chips will need replacing, but not all will be easy to replace due to their location 
and disruption to processes whilst the work is being carried out. 


3.3 Issue 


“The effectiveness of action which has already been taken to avert problems in Government, large 
corporations and small businesses”. 


3.4 FSB Comment 


There have been many initiatives, for example: 
— Taskforce 2000 Seminars. 
— British Computer Society Year 2000 documents Volume | and 2. 
— Computer Software Services Association Millennium Directories and advice. 
— CCTA Internet Year 2000 advice sites and “Tackling the Year 2000” Guides. 


The above have made an excellent contribution but very few people know of the work carried out because 
the profile has been too low. There is a great need to make the above work known to all employees within all 
organisations and to encourage regular staff meetings within those organisations to keep staff updated and 
involved in the solutions. 


3.5 Issue 


“The role of Government in raising awareness of the potential problems and in seeking solutions and the 
respective roles of Taskforce 2000 and the recently launched Action 2000”. 


3.6 FSB Comment 


The role of Government is vital. Just as when any nation is faced with a major threat, every citizen looks 
up to the government for direction and support. As the government is caught up in carrying out its own 
procedure for compliance, it would be useful to make those efforts to obtain information available to avoid 
massive duplication of such activities going on just now around the UK. There will be suppliers with which 
all organisations have much in common, and if replies to the government on the subject of compliance were 
made available on a database, this would save a great deal of time. Downloadable letters to MDs of software 
companies assuring of compliance, for example, could be downloaded and placed on file in relation to a 
company carrying out its inventory and needing such evidence from a particular supplier. 
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3.7 Issue 


“The extent to which new systems and software are “millennium compliant”. 


3.8 FSB Comment 


There is sufficient evidence from the research of such investigators such as Karl Fielder and Chris Anderson 
that no one can be confident in any PC system being compliant which is currently available for purchase. Not 
only are there likely to be hardware problems despite manufacturers compliance statements, but operating 
systems and complexities within integrated software packages need attention. 


3.9 Issue 


“The development of contingency plans in the event of system and program failures”. 


3.10 FSB Comment 


This is a vital role of risk management and a must for all businesses. 


3.11 Issue 


“The legal implications of disputes over liability for compliance costs and system and program failures”. 


3.12 FSB Comment 


As insurance companies will not provide professional indemnity for those offering Y2K solutions, the risk 
is further placed on the shoulders of management. Codes of Practice must be set up to protect the customer 
from malpractice as far as is possible. The legal implications have been explored in the “Tackling the Year 
2000” guides. 


The following list of potential defendants is possible: 
— Officers and directors of companies who allegedly fail to respond in a timely fashion to Y2K; 
— Manufacturers and sellers of computer software and hardware; 
— Managers and manufacturers of traffic control or schedule control systems; 
— Owners or managers of property which utilise date-dependent electronic devices; 
— Business entities dealing with electronic data exchange or commerce; 


— Financial institutions that fail due to the Year 2K problem. 


Many types of litigation could result from Year 2000 issues: 
— Litigation file by clients whose finances have been damaged. 


— Litigation filed by shareholders of companies whose software does not safely make the year 2000 
transition. 


— Litigation associated with any deaths or injuries derived from the year 2000 problem. 
—  Class-action litigation filed by various affected customers of computers or software packages. 


— Litigation filed by companies who utilised outsource vendors, contractors, consultants, or 
commercial Year 2000 tools but where Year 2000 problems slipped through and caused damage. 


— Litigation against hardware manufacturers such as computer companies and defence contractors if 
the Year 2000 problem resides in hardware or embedded microcode as well as software. 


é Many of these areas will involve defending the suits by insurers, costing billions of dollars in defence and 
amages. 
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ANSWERS TO SPECIFIC QUESTIONS 


4.1 Question 


What is your estimate of the seriousness of the millennium bug problem? 


4.2 FSB Answer 


It is very difficult to assess the seriousness of the Millennium bug problem due to the fact that, although it 
is appreciated that it will affect everybody from all walks of life, it is not appreciated to what extent. The large 
corporations and Government have undertaken projects to identify the inventory and assess the risk or have 
applied remediation costs to this. The one “grey” area, however, is the embedded systems of which there are 
millions used in everyday life, both at the office and at home. A statement has been made that 4 billion chips 
were produced in 1996 of which only 5 per cent are Year 2000 compliant. This must be of large concern to 
anybody involved in the Millennium bug. 


Another statement comes from KLM who have suggested that they will not be flying on 1 January 2000. 
The costs implied by so doing perhaps suggests the seriousness that should be put on this. 


4.3 Question 


To what extent do you think that UK businesses and other organisations have done, or will have done, 
enough to avert any potential problems? 


4.4 FSB Answer 


UK Businesses have addressed the problem from a very constructive viewpoint and they have, in general, 
done more than their European counterparts. Most of the businesses have followed a proven methodology 
and quite a few have subscribed to newsgroups on the Internet to assist them. As indicated, above the majority 
of large organisations and Government have or are about to, complete the inventory and risk assessment 
phases and will be embarking on the remediation work over the next couple of years. A number of large 
organisations have stated that they will be Year 2000 compliant by the end of 1998 which, although it may 
be a tall order, will assist in testing year end procedures before it is too late. One of the major concerns is the 
complacency of the SMEs and the distinct lack of any corrective action. This is due mainly to the lack of 
awareness amongst them AND the so-called “silver bullet” which is supposedly coming in 1999. The majority 
of SMEs do not appreciate how it is going to affect their business and a lot more work requires to be done 
in this area. The Federation of Small Businesses (FSB) is addressing this very issue and is proposing a plan 
of action to disseminate the awareness and to provide tools and advice to their members. 


Other similar projects are being undertaken by different organisations, some involving the banks and large 
organisations who are prepared to work in partnership with the “feed system” (the SMEs) to ensure that the 
impact is minimised. The “heavy hand” approach by large organisations to say that they will not purchase 
from SMEs who are not able to provide assurance of Year 2000 compliance will happen very shortly and this 
should be avoided. 


4.5 Question 


Do you think that the Government has done enough to raise awareness of the problems associated with 
the date change or to encourage action to avert problems? If not, what more should be done? 


4.6 FSB Answer 


The Government has been active in raising awareness by initiatives such as Action 2000 and Taskforce 
2000. However, a lot more needs to be done through working closely with organisations such as the 
Federation of Small Businesses. The whole of the UK plc could be affected if the risk is not minimised to 
controlled levels and this can only be done, in the time left, through representative bodies. This is one project 
whose date is finite and a degree of urgency is now required even if it be only that there is a plan in place for 
remediation work and budget for equipment to be replaced or upgraded in 1999. 


Further action which could be taken 


— Aclear statement from the Government delaying the introduction of the single currency allowing 
organisations to concentrate all their efforts on the millennium bug. 
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— Legislation to ensure that all goods sold with embedded chips or time/date stamps are Year 2000 
compliant. Additionally, all software packages, be they upgrades or new should carry the Year 2000 
compliant stamp. 


— Close liaison with action groups and representative bodies to monitor progress and to report on 
issues raised. 


— Tax concessions for Year 2000 remediation work. 


— Governmental departments’ assurance of the Year 2000 compliance and statement from the 
Chancellor informing the public of the actions taken by Government to minimise the risk. 


4.7 Question: 


What, if any, are the major constraints militating against progress being made towards identifying and 
applying solutions to prevent computer system and software failures at the millennium? 


4.8 FSB Answer 


One of the major constraints is the shortage of human resources available for remediation work. This is 
perceived to be worse than it is, and could be resolved by better organisation of the human resources available. 
There have been comments regarding the Welfare to Work programme, suggesting that many of these people 
could be trained as programmers overnight! This is somewhat naive. However, there are many resources 
throughout Britain, which could be used effectively from home by use of the Internet and the communication 
links which are already in existence. 


5 December 1997 


Examination of Witnesses 


Mr Barry HICKLEY, Managing Director, Electronic Printing, and member of FSB Business Development 


Committee, and Mr STEwART HALLIDAY, Managing Director, Xexco Group, and member of FSB 
Business Development Committee, the Federation of Small Businesses, were examined. 


Chairman 


292. Good afternoon, Mr Halliday and Mr 
Hickley. Thank you to both of you for coming along 
this afternoon and helping the Science and 
Technology Select Committee on this very important 
and time-limited problem. We have got to try and 
make a recommendation to Parliament on this 
matter as soon as possible bearing in mind the whole 
thing will be over one way or another by Ist January 
2000. Mr Halliday, are you going to take the 
questions primarily and then ask Mr Hickley to help 
you? To whom do we direct them? 

(Mr Hickley) To myself. 


293. Mr Hickley, would you therefore care to 
introduce yourself and then we will ask Mr Halliday 
to introduce himself too. 

(Mr Hickley) Certainly. My name is Barry Hickley 
and I have spent 30 years in the computer industry. I 
originate from IBM where I spent 24 years. I have 
been running my own consultancy business for seven 
years involved in the IT business. We also do 
publishing for various organisations around the 
world. My colleague, Mr Halliday, has with myself 
been working on the Federation of Small Business 
Committee looking into the year 2000 problem and 
how it affects the members. 


294. Thank you very much indeed. People think of 
some very big problems that might arise on New 
Year’s Eve/New Year’s Day 1999/2000. One that is 
always talked about is air traffic control, probably 
one of the biggest ones and one of the most 


frightening. If someone was to say to you that the 
small businesses you represent will only have small 
problems, all the big problems are going to be for big 
business, how would you react? 

(Mr Hickley) 1 believe the small business 
community will affect many of those large 
corporations. We are suppliers to those businesses. 
We provide services and also products to those large 
companies, so if we are unable to comply and meet 
the requirements of year 2000 I believe we could 
seriously impact those large businesses. We in our 
own right will or could have problems. It could cause 
us to stop trading as small organisations depending 
on the nature of our businesses. 


295. You would not necessarily disagree with my 
statement but what you would say is we are all part 
of the big business problem because we are all one 
continuum and you are part of that continuum? 

(Mr Hickley) Yes, that is correct. 


296. To what extent are the small- and medium- 
sized enterprises that you represent critically 
dependent on IT systems and to what extent are they 
just a luxury that they like to have? 

(Mr Hickley) Increasingly, we are seeing members 
of our association, and we have more than 100,000 in 
the United Kingdom now, moving towards using 
computers. I believe that not quite 50 per cent of us 
are already using computers in one form or another 
so it has become a very integral part of our day to day 
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business and essential for many of us because in 
order to keep our companies small we have to use a 
lot of technology particularly PCs and software. 


297. Here we are now in February of 1998 and if 
you asked the chief executives of many of the small 
companies that you represent to put things in priority 
order where would they put millennium compliance 
of their IT systems compared with late payments, the 
French lorry drivers’ strike, getting VAT returns 
back or making sure their tax returns are in before 
Ist April? 

(Mr Hickley) Naturally enough many small 
businesses have one or two or very small numbers of 
employees and the person running the day-to-day 
business is also responsible for setting up and looking 
into these future problems, year 2000 being one of 
those. So the day-to-day business will obviously take 
the majority of their time, running the business and 
keeping it going, but most certainly there will be a lot 
of interest in the year 2000. I believe they are 
beginning to become quite nervous as to what the 
impact will be to them. They are giving up more time 
to find out. This is usually done through associations 
like our own and other bodies rather than going out 
and doing the work themselves. 


298. Do you think there is a role for large 
companies? I have met one or two privately in the last 
week or so and they have talked about computer 
compliance, and some of them have said that they 
would be prepared to assist small- and medium-sized 
companies particularly if they were their customers 
or their suppliers. They are not suggesting doing it 
for profit, they are suggesting doing it because they 
are large and other people are small but also because 
they are part of the supply chain. Do you think there 
is a role for large companies to act as grandfathers to 
smaller ones? 

(Mr Hickley) Yes, most certainly and it is one of 
the things that we, as a group, are forging, this 
alliance with the large corporations. We have already 
done a lot of work in this area and we propose to do 
even more. We have been working with the DTI and 
with the SME sessions that they have been 
organising. We have had forums and round tables 
looking at this and trying to find ways in which we 
can work closer together and most certainly, yes, we 
would like to think that we can turn to them. 


Mr Atkinson 


299. Clearly commercial organisations that exist to 
support smaller businesses as clients, like banks, the 
accountancy profession and so forth, they 
themselves have a vested interest in ensuring that 
their clients are millennium-compliant. What advice 
have they been giving to their clients to ensure that 
both remain in business and what evidence are your 
members experiencing that banks are now taking, or 
are shortly to take, a strong line against their clients 
who are showing that they do not know and do not 
care about the need to be millennium-compliant? 

(Mr Hickley) Well, I feel that the banks, the 
financial institutions and the venture capital 
companies have a vested interest naturally in these 
small companies doing well. They have invested 
' money and are probably loaning money to those 
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companies still today. I believe that most of the small 
organisations feel responsible to the banks, although 
they may feel slightly bent out of shape if the bank 
threatens them and wants to take back the money 
and I think that would be the wrong approach. I do 
believe, though, that our Federation members, for 
example, are being encouraged to develop plans that 
they can show to their banks and the like showing 
that they are actively involved in doing something 
which will enable them to become year 2000- 
compliant. It is no good for them to sit back and just 
wait until the last moment and say, “We did not think 
we should do anything. It should happen 
automatically for us’, so we feel strongly that we 
must work together with companies, financial 
institutions and banks. We have also seen packages 
from some of the banks where they have actually 
given information, a help desk and various other 
advice to help our members. 


300. Surely it is reasonable for a bank, which has 
as a client with a large overdraft and no intention of 
responding to the growing warnings that they need to 
be aware of, to take action to warn the client that his 
overdraft is at risk? 

(Mr Hickley) Most certainly, yes, I agree with that, 
but I do not think that the responsible small business 
person should just sit back, but should actively get 
involved and that is our recommendation as an 
association, that we should be, if you like, giving our 
banks a warm feeling that we are doing all we can to 
get on board with this problem. 


301. As you know, Action 2000 is emphasising that 
help and information is available through the local 
Business Link network. 

(Mr Hickley) Yes. 


302. Do you think that this is an appropriate 
channel to provide support for businesses and in the 
early days of Action 2000 what has been the 
experience of your members who have approached 
local Business Links to obtain the information and 
have they been provided with it? 

(Mr Hickley) I believe that quite a few of our 
members have actually been involved. Based on some 
of the comments that have come back, it is a little too 
late in getting on board for them and maybe the 
information is inadequate for them actually to make 
good use of it at this point in time, but I believe that 
anybody that is promoting the problem, any 
campaign that is identifying the depth of the problem 
and what people can do to correct some of these 
issues to help them become compliant I think has got 
to be good, and it is a situation that when we talk to 
our members, some have been involved and think 
quite highly and others have just not bothered at this 
stage to get involved with these Business Links and 
others. 


303. You just used the term “it may be too late”. 
Could that be true for a lot of your members? 

(Mr Hickley) I do not think so, not for the small 
organisations, no. We have tended to play a bit of a 
waiting game to see what the large corporations are 
doing. We are very much a feeder to those 
organisations. Therefore, we have sat in the back seat 
to hear what they are doing to see how we can 
approach this and find out exactly what it is we need 
in order to complement their activities in this area. 


a2 MINUTES OF EVIDENCE TAKEN BEFORE 





4 February 1998] 


Dr Gibson 


304. Following on with the actions of Action 2000 
to stimulate your members, there must always be 
some lost souls around everywhere—there always 
are in any organisation. 

(Mr Hickley) Yes. 


305. Do you think that those occur in certain 
sectors and, therefore, tailoring Action 2000 to those 
sectors is required? 

(Mr Hickley) 1 would like to ask Mr Halliday to 
answer this because he has been involved in this. 

(Mr Halliday) What we are looking at doing is 
actually sectorising out the members, the over 
100,000 members of the Federation, to try and isolate 
where the problems are and where more work needs 
to be done to ensure that our members are year 2000- 
compliant. 


306. What have you found so far in that case? 
(Mr Halliday) We are still at the early stages. 


307. Everybody tells us that they are at the early 
stages and then other people tell us that it is getting 
too late and I am getting lost somewhere in the 
midstream here. Tell me what you really feel please. 
Is it too late for some of them? 

(Mr Halliday) Certainly as small businesses we 
have had to take the lead from the large 
organisations and perhaps the large organisations 
have started too late and we have had to follow on 
from that and that is where I say that it is really too 
late. 


308. But in your dream world with all the resources 
in the world at your finger tips, what would you like 
to see happen now? Let us just say that it maybe is too 
late for some of them, the lost souls, gone. What 
would you want to do? What kind of help do you 
think your organisation can give which will stimulate 
them so that they will not turn around in the year 
2000 and say, “You never told us”? What do you see 
as the responsibilities you have in your organisation? 
What frustrates you most about it? 

(Mr Halliday) Certainly the frustration level 
comes from the lack of awareness that is out there 
within the small business community. 


309. Well, awaken their awareness, and how do 
you do that then? 

(Mr Halliday) Through the media, through 
publications, through magazines, through TV 
campaigns as an example, to ensure that it is getting 
to those rightful people. 


310. So you think they are educable about it then, 
do you, that they will listen if they see it in the media? 

(Mr Halliday) 1 think so, yes, because if they are 
concerned about their business, then they will 
certainly listen, yes. 


311. So they do not think it is like beef on the bone 
and scaring everybody to death? You must get that 
amongst some of them. 

(Mr Halliday) There has indeed been a lot of 
scaremongering, yes. One needs to try and take out 
that scaremongering and get down to the real issue 
and I think Action 2000 is a very good name and I 
think we need to act now. I think the talking is over 
and we have got to get on and do it. 
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312. What you are saying is that you really think 
that Action 2000 has got it right, that they are doing 
a good job and that is the way forward? 

(Mr Halliday) It is getting there, yes, and there is 
certainly a lot more that can be done, particularly in 
the small business area. 


313. I am sure we all talk to small businesses in 
relation to some other matters, so we will stimulate 
them of course too. I must say, I have gone to 
chambers of commerce in Norwich and they are not 
interested because they do not believe it is going to 
happen and there are lots of small businesses in 
Norfolk. I do not know if they are members of your 
organisation or they are outwith it, but what will you 
do about organisations like that and small 
businesses? Do you just leave them alone or do you 
recruit them on the basis of this knowledge that 
you have? 

(Mr Halliday) There certainly comes a point in 
time where you are knocking your head against a 
brick wall and eventually you stop, but as long as 
those businesses are aware that they could go under 
if they do not act, then that is all we can really do. 


Mr Atkinson 


314. Action 2000 has just launched its millennium 
bug logo. Is not the use of the word “bug” rather 
misleading. It implies it is some sort of virus. Surely 
the words “millennium time bomb” would have been 
much more appropriate to use as a logo for the 
Action 2000 campaign? 

(Mr Halliday) 1 would agree, yes. 

Dr Turner: You have got the delivery system there 
as well! 


Dr Williams 


315. Of the IT products on the market in Britain 
today, how many of those, if any, are still not 
millennium compliant? 

(Mr Hickley) We are told by many of the large 
computer producers and producers of other 
equipment using in-built computer technology that 
some of the products they are shipping today are 
compliant and we have done some estimates and we 
believe some of the products (although it is difficult 
to put an actual number on it) are in fact still non-. 
compliant from organisations we would have 
assumed would be able to guarantee that all their 
products would be compliant at this stage in the 
game. What we found is that some of the large 
companies, like IBM \for example, have very good 
quality checks on their technology and before they 
use the product it goes through this quality check and 
anything that is typically not compliant in the way of 
the PC board and so on would be pushed to one side 
and sold off to other manufacturers for them to use. 
Those products are coming back into the market 
place under other brand names as non-compliant. 
The mainstream products we are given to understand 
by IBM are compliant today and have been for some 
time now. 


316. Is it not irresponsible on the part of those 
traders that are marketing anything in 1998 which 
has a built-in two-year lifespan? 
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(Mr Hickley) Very rmouch so. One of the things the 
Federation has been doing is to lobby to get some law 
or certainly some direction from government to help 
us stop this because there are many people out there 
still buying computers today which they are going to 
have major problems with. 


317. Should there not be some kind of regulation 
to actually make it illegal? 

(Mr Hickley) It would be nice if there were some 
kind of legislation. 


Dr Jones 


318. Does the legislation not exist? It could be 
considered that it is not suitable for the purpose 
intended? 

(Mr Hickley) There is always a problem with this. 
It is very difficult to date and make and monitor. A 
lot of product comes from overseas. Other nations, it 
would seem, do not have the same worries we have. 
A lot of offshore products are coming in non- 
compliant. It is a major concern. Now how do you 
monitor this? How do you check this? Just by putting 
a label on is probably inadequate. You need some 
kind of standard set out and some way of getting 
back to those manufacturers that contravene those 
standards. It really is something that has to be 
monitored by the industry, I believe, more than 
anything. 


319. You said that IBM have good quality control 
checks, whatever. What about the other major 
companies? Is that the case for larger companies? 

(Mr Hickley) We know that Compaq and people 
like Apple and most of the other manufacturers also 
have checks. Many of those companies do not make 
the mother board and components for their PCs, 
they buy them from companies like IBM and other 
board manufacturers. Unless they have a quality 
check that says this is compliant or non-compliant 
then this gives them a problem. 


320. Is there something to be said for some of these 
companies carrying a label 2000 compliant-assured 
and for that compliance to carry a warranty so if 
there is a problem post 2000 you could go back? 

(Mr Hickley) That is right, this is the sort of thing 
we would like, but how do you ensure that those 
products do meet that standard. Someone at some 
point in time is going to have to sample check those 
PCs. You can do that today with software. You can 
actually verify those machines are compliant but who 
would be responsible for doing that is a very difficult 
one to administer. 

Mr Atkinson: May I come in here— 

Chairman: Mr Atkinson is going to tell us about 
his Bill! 


Mr Atkinson 


321. No. You are suggesting the need for some 
kind of independent certification of what has already 
been done to ensure they are millennium compliant? 

(Mr Hickley) Yes indeed. For example, we have 
seen the Xerox Corporation take a very responsible 
view. What they are doing is publishing to all of their 
re-sellers and internally in their company and to 
customers a list of all the products and against that 
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there will be “These products are compliant” “These 
products are non-compliant but they can be 
upgraded.” “This is what is involved in the upgrade” 
and also a list of products that can never be upgraded 
which you will need to replace. That is the kind of 
approach we would like to see from manufacturers in 
the computer industry. 


Dr Jones 


322. There are two approaches. One is buyer 
beware and you should just search out those 
products where a reputable company has said that 
they are compliant and you have some come back, or 
there is the idea that somebody should be responsible 
for testing and ensuring that the assurance is genuine. 
Which approach do you favour? 

(Mr Hickley) I think you have got both because I 
think you can believe the large organisations if they 
say they are compliant and if a machine gets through 
that is not I believe they will replace the product or 
fix the problem, but there are companies out there 
which we know are likely to try and bypass that 
circuit and not necessarily give you good quality. The 
people buying all those millions of chips produced 
last year where the majority have been non- 
compliant, where are they in the pipeline? They are 
going to come through into the product today and 
this year and next year and it is conceivable that those 
companies will go out of business by the year 2000 
and start up somewhere else as a different company. 
It is a very easy thing for them to do and there is no 
come back. 


323. Would it be fair to say that so far your 
organisation’s approach to this whole issue has been 
exhortation to your members and that therefore your 
assurance earlier that you thought the majority 
would be millennium-prepared is really not based on 
any real evidence as certain later replies indicate? 

(Mr Hickley) That is correct. It is very much left up 
to the individual business person themselves to say 
whether they are compliant or not or if they are 
interested in doing anything but you have also got to 
divide the businesses or the industries into sectors. 
Some are very dependent on computing, others have 
very little computing. Those companies that just do 
their accounts occasionally or use them to write 
letters are not going to be seriously impacted by the 
problem as it stands today. If they change their 
direction or change their business in some way then it 
is conceivable they will find themselves exposed and 
have a serious problem around that timeframe. 


324. So we have got your organisation and other 
small business organisations exhorting _ their 
members to be aware of the issue? 

(Mr Hickley) Yes. 


325. We have got bigger companies developing 
relationships with their supply chains and we have 
got Action 2000? 

(Mr Hickley) Yes. 


326. We have got all these things going on at once. 
Everybody is doing their own thing. Could there not 
be more efficiency if somehow or other this is drawn 
together? Perhaps you would say Action 2000 should 
be doing that. Are you confident that they are? 
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(Mr Hickley) I think you are correct in what you 
say but you have to approach a small business 
differently to some of the medium-sized businesses 
and you have to approach them differently again to 
the large corporations. The large corporations using 
mainframes and mid-range systems have to make all 
their changes in software whereas the PC user makes 
changes in hardware and software because they need 
the applications to support that. So they do approach 
it in a different way. Their businesses are run 
differently. The large organisations do have people 
they can actually assign to that. The small business 
users, as I mentioned earlier, have got to get involved 
in running the day-to-day business. Some of them are 
just one person or a very small number of people. It 
is very difficult for them to take time out from their 
day-to-day business and do the risk analysis that is 
required to see how serious the problem is. That is 
where the FSB and some of the other associations are 
coming on board to try and draft risk analysis 
procedures to help these people, these organisations 
and along with the major suppliers, the vendors, they 
have given us their assurance that they will assist us 
and provide helplines. We ourselves are planning a 
helpline for our members where they can dial in on 
an 0800 number and get pointed in the right 
direction. We are making other proposals and 
suggestions similar to the holding of forums, 
education sessions, etcetera to try and educate these 
people, but it is very difficult to force them to do this. 


327. Are you satisfied, therefore, that mechanisms 
to actually bring together best practice and 
disseminate them are evolving satisfactorily or do 
you think there needs to be some impetus to 
develop this? 


(Mr Hickley) Yes, I believe it is evolving very 
slowly and we need to somehow drive this forward as 
a business community. Certainly it is happening at 
the high end user community but it is very slow to 
take off in the small business environment and even 
in the medium-sized businesses. 


328. Who has the responsibility for driving that 
process forward, would you say? 


(Mr Hickley) I think we all have responsibility, the 
associations that support these members, possibly 
the government. 


329. But it seems that everybody has been waiting 
for things to happen. 


(Mr Hickley) I think we have had to. We have had 
to take guidance because we would all be going off in 
different directions trying to resolve problems that 
we did not fully understand at this stage and it is not 
until these large organisations have got together and 
spent millions of pounds or dollars in investigating 
this and understanding the depth of the problem that 
we are beginning to get a spin-off effect from this to 
understand that whilst we are much smaller and it is 
only a small part of what they found as a problem 
which will affect us, it is still serious enough for us to 
take it step by step and try and fix it as we go. 
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Dr Kumar 


330. In your submission you have suggested that 
the single currency should be delayed in order for you 
or your organisation to concentrate on the 
millennium bug to which a lot of effort is being given. 

(Mr Hickley) Yes. 


331. To what extent is the euro really detracting 
from dealing with the problems of the millennium 
bug? 

(Mr Hickley) This has actually been covered by a 
different committee within the Federation. We have 
not as a year 2000 group taken that and linked the 
two together. What we have found is that it is 
producing an effect to our members that they are 
having to do both things in parallel and they really do 
not have the manpower to do this. 


332. Would you be able to assist us—in writing, if 
you like—by making some sort of assessment of the 
difficulties you are facing regarding that? 

(Mr Hickley) Yes, certainly. We would be able to 
feed that back to you.! 

Chairman: We look forward to receiving it in a 
timely way, preferably before January 2000! 


Mr Beard 


333. In your submission you have called for tax 
concessions to help companies meet the costs of 
remedial work. What kind of scheme do you have 
in mind? 

(Mr Hickley) I believe that certain sectors of the 
small business community are very dependent on 
their computing systems. Now, some of those 
companies have tended to use relatively old machines 
and they have been upgrading wherever they can, but 
they are still talking quite low-level and early 
technology, even though they use these machines on 
a daily basis. Some of those organisations will find it 
very difficult to finance replacement machinery 
which in many cases they certainly will need to. For 
these members, we need a scheme, perhaps a tax 
benefit scheme, whereby they could upgrade their 
businesses to later generation products. Also the 
software needs to be in line because if you start 
changing the hardware, you then have to bring up the 
software to match, and that is quite a high expense 
for a small organisation. Possibly loan schemes, low- 
interest loan schemes from the DTI or other 
organisations would be useful for certain industry 
sectors, having assumed that they would be able to 
justify a true need to upgrade their equipment for the 
year 2000. 


334. How would you differentiate between those 
who needed help and those who did not? 

(Mr Hickley) In many organisations you use a 
computer just to type letters and it is that kind of 
organisation, I feel, that would probably get by, 
certainly for a period of time. Other organisations 
that depend on financial systems, on database 
systems, applications like that, they will find it very 
difficult and in fact it could actually cause them 
serious problems when the year 2000 comes along if 
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they are not fully compliant, so those are the kind of 
organisations, I think, that depend on the computer 
for their business. 


Dr Williams 


335. Obviously asking for any kind of tax relief is 
a very difficult process. Coming from your sector of 
industry, information technology is probably the 
most profitable sector in the last five or ten years and 
alot of people out there will be making small fortunes 
during the next year to 18 months tackling the 
millennium bug. Surely if there is money to come 
from anywhere, it is probably from the IT industry 
itself that that money should come, not depriving the 
Health Service and other priorities that the 
Government would have. 

(Mr Hickley) It would be nice if they shared their 
profits. It is very difficult, is it not? 


336. For a company like IBM, a long-established 
company which has been very profitable for decades, 
or MicroSoft and all those sort of whiz-kid 
companies, surely if there is a major bill to be paid, it 
should be paid by those people and not by Mr 
Taxpayer? 

(Mr Hickley) It would be good if we could 
convince them that they should do this, yes. I find 
that very difficult, though, to get a company like an 
IBM or a MicroSoft, remembering that they would 
have to do the same in every country and not just in 
one country— 


Dr Jones 


337. You could have a windfall levy on their 
profits. 

(Mr Hickley) Well, yes, you could. 

Chairman: Just going back to Dr Williams’ point 
about Mr Taxpayer— 

Lynne Jones: And Mrs! 


Chairman 


338. Yes, and Mrs Taxpayer, there is no 
suggestion, is there, that the taxpayer will be paying 
to help small companies become miullennium- 
compliant, apart from Action 2000 with rather a 
limited budget of £2 million or £3 million which of 
course is taxpayers’ money, but there is no suggestion 
of any other help from the taxpayer, is there? 

(Mr Hickley) I believe it has been under discussion 
within the Federation, yes. 


339. Within the Federation, but not within the 
Government? 
(Mr Hickley) No, not to my knowledge. 


Mr Atkinson 


340. Has or will the Federation be submitting to 
the Chancellor to take into account, in compiling his 
March Budget, a specific tax allowance to write off 
the expense of compliance to concentrate the minds 
of companies and to encourage them to take this 
action and will not the Chancellor say, as has been 
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suggested, that this would be a subsidy when in fact 
it should be in the business of self-interest and other 
people should not be paying for that? 

(Mr Hickley) Yes, this has actually been done. 


341. Including your submission? 
(Mr Hickley) Yes. 


Dr Turner 


342. Since you cannot obviously assume that any 
suggestions that you make for government action 
will be implemented, what advice do you have now 
for government and for your own members? 

(Mr Hickley) Well, for our own members we must 
naturally take this very seriously. We must also try to 
work with the large corporations that we indeed in 
turn supply service and product to and a number of 
those companies have come forward and said, “We 
will also, wherever possible, try to assist you 
financially. For example, we will delay taking 
payment on product to become compliant if it is 
genuinely for the year 2000”, so a number of 
companies have actually offered this to us and we 
want to try and promote more of this kind of 
interaction between the large organisations and 
ourselves. From a government standpoint, I guess we 
are looking for as much support as we can get, 
making sure that our members do not get ripped off 
by manufacturers that are selling products that are 
so-called compliant and are not compliant. It is very 
difficult for us to police that situation and it is true 
also for software companies that really have us over 
a barrel, that we really must make sure that they do 
not just make the new product compliant, but it must 
be downward compatible, so that we can take our 
databases from last year and bring them up to the 
standard and four-digit-year configuration that we 
are seeing in the current packages and that is 
something that a number of companies are beginning 
to address, but it is not in place. We are told that 
Sage, for example, has year 2000 compliance on its 
software, but we are not sure if it gives us the 
wherewithal. to take existing databases of 
information and convert them into the new format, 
so we could be left with two databases, so we would 
need to bridge databases. It would be good if we 
could apply some pressure on these organisations to 
make them give us a good deal. 


Chairman 


343. Well, thank you very much indeed, both Mr 
Hickley and Mr Halliday. Just before you both go, 
can I just put one question to each one of you. Mr 
Hickley, may I ask you how millennium-compliant is 
Electronic Printing and, if it is not, what are you 
doing about it, and to Mr Halliday, how millennium- 
compliant is the Xexco Group and, if it is not, what 
are you doing about it? 

(Mr Hickley) The electronic printing industry, I 
mentioned Xerox, for example, which is really one of 
the leaders along with IBM and Hewlett Packard, 
they are all working on year 2000 compliancy 
programmes. They have all offered us a helpline 
where we can go back and discuss problems with 


716 MINUTES OF EVIDENCE TAKEN BEFORE 





4 February 1998] 


[Chairman Cont] 

them for our members and they will also provide us 
with information for our home page which we are 
developing as well for the year 2000. 


344. So the organisation you are closely attached 
to you are content is moving forward well and should 
be ready six months ahead of the due date? 

(Mr Hickley) I believe from the electronic printing 
standpoint that most of the organisations we have 
currently spoken to will be compliant, although not 
all of their products will be compliant; we may have 
to replace some of those as I have mentioned. 


345. Mr Halliday, is Xexco Group? 

(Mr Halliday) We have obviously addressed the 
issue in a big way because we are consultants in the 
year 2000 field anyway so if we have not got our own 
house in order— 


346. We all know that cobblers are always the 
poorest shod! 

(Mr Halliday) Yes, indeed. We have looked at our 
systems and some of our hardware is non-compliant. 
We have actually put into place a budget to replace 
that equipment in 1999. The majority of the software, 
our accounting software is non-year 2000 compliant. 
We are going to have to change that and that will be 
at the end of the tax year that we change that over. 
As Mr Hickley was saying, we have got a problem 
with the data as it stands at the moment and we have 
to change that as well. 
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Mr Atkinson 


347. It is a close-run thing? 

(Mr Halliday) Yes, we have still got some work to 
do but we have got a plan in place and we have got a 
budget in place. 


Chairman 


348. Your own personal problems, your 
company’s problems actually focus your mind on the 
SBs problem because you are living in the real world 
yourself and it helps you with your members? 

(Mr Hickley) Indeed. 

Chairman: On that note may I thank you both 
very much indeed for coming along. We wish you 
well in all that you have to do. Thank you for helping 
us because we are part of the team that you are part 
of and that is the general team of propagating the 
problem and hopefully indicating and pointing 
towards solutions. We are all in the same boat and I 
hope we all row it ashore. Thank you. 


Supplementary Memorandum Submitted by the Federation of Small Businesses 


PREAMBLE 


In its written evidence to the Science and Technology Committee, the FSB suggested that the single 
currency should be delayed in order for small businesses to concentrate on the Year 2000 issue. 


The Committee was interested as to how the Year 2000 issue, combined with the preparations small 
businesses are having to make for the introduction of the single currency, is impacting upon such firms. 


FSB RESPONSE 


There is now evidence to suggest that despite general opposition amongst small business, in principle, to 
the single currency, many small firms are realistic enough to accept that they must make practical decisions 


regarding the introduction of the single currency. 


Below are the practical implications small businesses will have to consider, in many cases regardless of 
whether the UK is in the first wave of entrants or not. Big business can adapt relatively easily to these 
implications; for small firms the impact on management time and costs on business are far greater. 


1. Basic changes to cashtills will have to be paid for so that they can cope with two different currencies. 


2. Slot machines—many of which were designed years ago—will have to be updated. Vending machines 
account for 10 per cent of all coin transactions in the UK and the majority exist on small retailers’ 


premises. 


3. Workers will have to be trained in handling the new currency. 


4. Goods will have to be priced in two different currencies with four different prices (the regular price, 
the sale price, and a calculation in sterling and euro). 


5. Many small business owners are already facing pressure from their large business customers to invoice 


in euro rather thay sterling. 


Small businesses that face adapting to cope with these practicalities will find it an added burden with the 


costs of Millennium compliance. 
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Those businesses that face pressure from big business customers to invoice in euro rather than sterling will 
have to modify computer software (and maybe hardware) to prepare euro invoices and for separate euro and 
sterling accounts. It remains unclear whether such software will be both ‘euro compliant’ and Year 2000 
compliant. If not, then small businesses will face two increases in costs. If they are, then obviously these 
businesses will be able to kill two birds with one stone. 


CONCLUSION 


Because of the administrative, financial and management costs of complying with the Year 2000 issue and 
simultaneously preparing for the introduction of the single currency, the FSB proposes that the introduction 
of the euro in the UK be put on hold. Many businesses (ie those based in tourist areas and transport hubs) 
will have to adapt for the introduction of the euro, whether the UK joins in the first wave or not. 


Some businesses may benefit from being forced by large customers to invoice in euro because they will have 
to modify their software anyway to cope with the Year 2000 problem, but only if the software/hardware is 
compliant for both. Assurances and guarantees should be made by manufacturers and suppliers that goods 
sold are able to invoice in euro and Year 2000 compliant if they are marketed as such. 


March 1998 
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Memorandum submitted by the NHS Confederation 


1. INTRODUCTION 


The NHS Confederation is the representative organisation for over 500 trusts and 100 health authorities 
and boards nationwide. We welcome the opportunity to give evidence to the inquiry. 


2. MAIN POINTS 


Accountability for achieving Year 2000 implementation lies with trust and health authority Chief 
Executives and with primary care contractors. The centre has confined its role to advice and 
guidance. 


Year 2000 is mainly a problem of management. The technical changes tend to be fairly simple but 
organising, implementing and paying for them is difficult. Equally important is the task of ensuring 
business continuity throughout the service, which has one of the most extensive and complex supply 
chains in the country. Furthermore, in extreme, the NHS may need to function under increasing 
pressure in an environment of failing infrastructure. 


Budgetary estimates for Year 2000 implementation are difficult to obtain. There are some figures 
for computer systems, none for medical devices and little for estates or contingency planning. 


The policy on funding is that Year 2000 costs must be met from existing resources. This is impacting 
in two ways: the pace of compliance activity and the level of compliance likely to be achieved when 
solutions are costed. 


The NHS target dates of detailed plans and budgetary estimates by March 1998 and compliance by 
December 1998 will be very difficult to meet for many parts of the NHS. The question of extra 
funding needs to be reconsidered. 


There is clear evidence that Year 2000 work is the subject of much local reinvention. There needs 
to be stronger central support in key areas, particularly pressure on suppliers, overall contingency 
plans and testing on common systems by witness testing. Regional Offices need to provide 
consistent support. 


The Year 2000 problem needs to be seen in the context of the enormous change agenda arising from 
the white papers on health and major service reviews, such as mergers. There will clearly be strains 
on the service in meeting these challenges. 


The overall assessment is that there is a major problem but it is feasible to address the vast majority 
of issues. 


3. WHAT ACTION IS BEING TAKEN Across NHS Trusts AND HEALTH AUTHORITIES TO AVOID PROBLEMS 
CAUSED BY LACK OF COMPUTER COMPLIANCE IN 2000? 


3.1 There isa NHS Year 2000 Steering Group. The IMG (Information Management Group) is taking the 
lead within the NHS on Year 2000 issues. There are also many bodies within the Service working on particular 
issues. These are co-ordinated by the NHS Executive’s Year 2000 Steering Group. Chaired by Ron Kerr, 
Director of North Thames Region, it consists of representatives from MDA, NHS Estates, NHS Supplies, 
FHS, NBA, PHLS, DPB, PPA, IMG, the eight English Regions, and the Primary Care Division of the 
Department of Health. The main function of the Group is to ensure that all aspects of Year 2000 in the NHS 
are covered, and to avoid unnecessary duplication of effort. 
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3.2 The NHS Executive has issued guidance for health authorities and GPs advising them that the Year 
2000 problem should be the first priority after the provision of clinical services. 


3.3 In early October the NHS EL(97)59, the Year 2000 Problem, was sent out to all Chief Executives. Its 
key points are: 


— Chief Executives are accountable for all problems in their organisations resulting from Year 2000. 


— Chief Executives of health authorities are also responsible for co-ordinating Year 2000 work in 
primary care. 


— Regional Offices will monitor the progress of Year 2000 projects. 


— Each organisation must send outline project plans to its Regional Head of Information by 
30 November 1997. 


— Detailed plans must be submitted by 31 March 1998. 
— Nonew money will be made available. 


3.4 The Government will require that any trust or health authority which has not got its systems ready and 
fully tested should notify the department by 31 December 1998. 


3.5 Health Service Guidelines, HSG(97)40, were sent out with the EL. These give further guidance on the 
steps NHS organisations should take concerning Year 2000. They emphasise the need for contingency 
planning, and the need for Year 2000 managers to have easy access to the World Wide Web. 


3.6 Most of the Regional Offices now have a team dedicated to Year 2000. These are intended to provide 
support at local level and to co-ordinate discussions with suppliers. The NHS Executive set up a Year 2000 
“Helpline” in July 1996. The helpline has received over 400 calls. The current rate of calls is in excess of 90 
per month. 


3.7 The Year 2000 team has been recently expanded and is to report on the progress of two Year 2000 
projects in the NHS. Two natural communities, based around East Riding and the Isle of Wight Health 
Authorities, will be monitored closely over the coming months. Northern General Hospital NHS Trust in 
Sheffield will also be providing information on its project. The NHS Executive’s Year 2000 team will publish 
advice, findings and conclusions from these sites and other selected sites on a regular basis. 


3.8 NHS organisations are having trouble getting information from suppliers. Local organisations are 
having to commit local resources to try to establish compliance. This is creating a huge duplication of effort 
which is made more wasteful as individual organisations have little leverage on manufacturers to insist on 
compliance statements being issued within reasonable timescales. NHS organisations are keen that the 
government applies further pressure to ensure that system suppliers are Year 2000 compliant. Introducing an 
accreditation system for multi-national suppliers to ensure compliance should also be considered. 


3.9 The NHS Executive’s Year 2000 team has recognised that organisations would be helped by receiving 
detailed information about the top 30 or so NHS IT suppliers. They have approached these suppliers and 
intend to publish detailed information soon. This information will be added to the Executive’s Year 2000 
supplier database which is currently being completed. They are also asking for information from Year 2000 
workers in the NHS to put on the website. A similar exercise is being done with the top GP systems suppliers. 


3.10 There is a central database of healthcare IT products that tells whether they are Year 2000 conformant 
on the Web Searchable Site. It is sponsored by a number of organisations, including the Computing Services 
and Software Association (CSSA) and Task Force 2000. It is still fairly thinly populated but does have a 
number of entries for healthcare products. It also has entries from general suppliers such as Digital, ICL and 
Microsoft. 


3.11 There is concern over Supplier Statements on Year 2000. The Year 2000 team has suggested the best 
definition to be that produced by BSI. The British Standards Institute (BSI) has issued document PD20001, 
“A Definition of Year 2000 Conformity Requirements”. This was with input from the NHS. 


3.12 There are a number of Year 2000 mailing lists and discussion groups on the Web, but none are 
dedicated to NHS issues. The government hopes to change this as soon as possible by adding such a discussion 
group to the Year 2000 Web site. 


4. WHAT ESTIMATE, IF ANY, HAS BEEN MADE OF THE NATURE AND SCALE OF THE PROBLEM THAT IS FACING 
THE NHS? 


41. The Year 2000 team has produced a briefing on Risk Management. This states “Year 2000 represents 
an unprecedented threat to all parts of the NHS. The sheer scale and complexity of the Year 2000 problem 
means that it must be addressed as a project with the highest priority within an organisation. Bear in mind, 
however, that Year 2000 projects have a number of unique attributes: 


— For most organisations Year 2000 will be one of the most demanding and major projects they have 
ever undertaken. 
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— The deadline is immovable. 

— The deadline bears no relation to the task. 

— Everybody has the same deadline. 

— There is no experience of previous or similar projects to rely on. 


Taken together these factors amount to an unprecedented level of risk, for the project and the whole of the 
organisation undertaking it. It is essential, therefore, to attempt to manage this risk.” 


The Year 2000 Website notes that the budget is almost impossible to know before the programme is well 
underway and new information becomes available almost continuously, requiring changes in the plan. 


4.2 Problems have already been reported with major Patient Administration Systems. Any piece of 
equipment that uses a computer chip may be affected. As well as clinical, administrative and financial systems, 
this may include patient monitoring equipment, security systems, building control systems and most PCs. All 
NHS organisations may be affected, from large acute Trusts to GP surgeries; from ambulance services to 
Health Authorities. Software is the area of greatest concern, particularly in applications which have forward 
looking functionality such as appointment management. The greatest area of medical risk is embedded chips 
in medical devices. Acute trusts pose the greatest risk with the greatest number of devices and critical 
procedures such as theatre scheduling, hospital admissions and dosages. Practices could suffer from the 
following problems: call/recall systems may not function properly; systems may calculate ages from dates of 
birth incorrectly; pharmacy and stock control systems may reject drugs as beyond their “use by” dates and 
telephone switchboards and pager systems may not work correctly. 


4.3 Each organisational environment is different. Common systems can be used in different ways 
depending upon the organisational practices. This is compounded by the amount of disparate systems and 
critical links. 


4.4 Sample costs for computer systems are: 


Health Authority (exc primary care) £100—200k 


Primary Care £450k—£1.3m per health authority (€£2-22k per GP practice) 
Trusts £30k-£1m 

Community trusts: £30-150k 

Acute trusts: £0.2-£1m 

Teaching hospitals: £0.5-£1m 


4.5 Members are concerned about resourcing compliance from discretionary capital budgets. Clarity is 
needed on the scope for a major Year 2000 compliance programme to be financed through PFI. 


4.6 NHS organisations have been concerned at the attitude and slow speed of information from the 
Medical Devices Agency (MDA) on medical equipment. The MDA issued basic guidance in November 97 
on the appropriate action by device users and manufacturers. The guidance asks medical equipment 
manufacturers to identify any of their products which are affected by Year 2000 problems and make this 
information available to users and other interested parties, with an indication of the appropriate remedial 
action. 


4.7 Testing is one of the biggest problems facing most NHS organisations. Few have the expertise or the 
resources to test any but the simplest systems. It seems unlikely that external organisations will be able to test 
NHS systems at a reasonable price. The Year 2000 team have recognised that witness testing may be the only 
way that the NHS can find enough resource for Year 2000. Many of the Regional Offices are investigating 
how it might be organised on a regional basis. The government is also encouraging two or more 
representatives from organisations in the Region to witness the testing of each major system, to write a report 
detailing the tests and results, and make it available to the rest of the NHS. 


4.8 Legal risks may arise from damages claims or unlawful processing of data under the Data Protection 
Act—this could apply to trusts, health authorities and GPs. Members are concerned at press reports of some 
large insurance companies considering adding Year 2000 indemnity clauses to their policies. The impact is 
that the exact cause of information systems failure at the turn of the century may be very hard to prove, for 
example, that it has not been as a result of “negligence” in sorting the Year 2000 problem out. 


5. WHAT IS THE LIKELIHOOD OF SOME PROBLEMS IN 2000 AND WHAT CONTINGENCY PLANS HAVE BEEN MADE? 


5.1 The overall assessment is that there is a genuine risk and problem but that it is feasible to address the 
vast majority of issues. / 


5.2 To date most members have concentrated on assessing the scope of the IT problem and are now 
moving to draw up contingency plans. 


THE SCIENCE AND TECHNOLOGY COMMITTEE 81 


11 February 1998 ] [ Continued 


5.3 Many manufacturers have not yet issued statements of compliance, or non-compliance of their 
products. The longer NHS organisations have to wait for these statements the less time there is for response 
to non-compliance problems. There are still many major healthcare software systems which will not release 
a compliant version until Well into 1998. It has been the norm for suppliers to claim that particular versions 
are compliant but the caveat to this is which hardware, operating system and interface are in use. The only 
way of knowing is by testing since the extent of compliance very much depends upon the environment in 
which the system exists. 


5.4 NHS organisations recognise that because of the extent of the problem, it is unlikely that all systems 
will be known and audited. For some the key to managing the problem has been the identification of critical 
systems (those systems that can cause harm to patients and a full range of payments). 


5.5 NHS Organisations have been instructed to ensure that all new systems are compliant. Organisations 
are routinely incorporating a Year 2000 compliance clause in all contracts or purchase of new equipment. 


5.6 Contingency plans require development to address a possible scenario of major cities being without, 
heat, light and clean water, transport as well as shortages resulting from failed distribution systems. 


5.7 Risk assessment and contingency planning also involves preparation for emergency health care in 
January 2000; assessing the interface to existing plans for winter pressures and flu and funding of contingency 
arrangements. 


6. WHETHER STEPS HAVE BEEN TAKEN TO AVERT THE PROBLEM NATIONALLY, OR LOCALLY? 


6.1 Accountability for achieving Year 2000 implementation lies with Trust and Health Authority Chief 
Executives and with primary care contractors. The centre has confined its role to advice and guidance. 
Therefore the steps to avert the problem have been taken locally. 


6.2 Most organisations are at the inventory stage and information from suppliers is still incomplete. The 
key areas remaining to be tackled in whole or in part are prioritisation, testing, interfacing, risk management 
and contingency planning. 


6.3 The primary focus has been on computer systems while the other large areas of work relating to medical 
devices and estates are just beginning to be tackled. Interface issues, for example between internal trust 
systems and interface to external suppliers or telecommunications have not really been tackled. 


6.4 NHS organisations made early appeals to both central and regional NHS sources for assistance and 
guidance. For many members the result was insufficiently speedy to have a major effect on their programmes. 
The value of the Taskforce 2000 group (now Action 2000) and the NHS Executive Year 2000 team is 
recognised. 


6.5 Regional Offices need to take a stronger role in coordinating and support. Joint health authority 
funding is enabling work to develop on addressing information sharing and expertise, project management 
and contingency planning. Trusts and Health Authorities are now developing detailed project plans. It would 
be helpful if templates were provided. 


6.6 NHS organisations are looking at the problem within their broader work on Information Management 
and Technology Strategy. For example, linking in work on national initiatives like connecting GPs to 
NHSnet. 


Sources 
Submissions from Health Authorities and Trusts. 
NHS Year 2000 Information Pack. 
NHS Year 2000 Silver Bullet Update, November. 
Year 2000 Brifing: Risk Management. 
Year 2000 Website. 
NHS Executive EL (97) 59 and HSG (97) 40. 
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Examination of Witnesses 


Mr GRAHAM ELDERFIELD, Chief Executive, Isle of Wight Healthcare NHS Trust, Mr Tony Stock, Head of 
Information Management and Technology, University College London Hospitals NHS Trust, Mr 
MICHAEL KERIN, Chief Executive, Bexley and Greenwich Health Authority, the NHS Confederation, 


were examined. 


Chairman 


349. Mr Elderfield, gentlemen, may I start by 
apologising to you for keeping you waiting outside 
for a quarter of an hour. We do generally try to start 
on time; today, I am afraid, we had need for an 
extended private meeting before this evidence session 
and the consequence was that we have started late. I 
hope you will accept the Committee’s apologies on 
that particular point, and I hope you will also accept 
the Committee’s thanks for coming along this 
afternoon and helping us with this inquiry. I 
understand, Mr Elderfield, that we direct our 
questions to you and you will do your best to answer 
them, and if you wish you can field them, of course, 
to your two colleagues; is that correct? 

(Mr Elderfield) That is correct, Chairman, thank 
you. 


350. I wonder, Mr Elderfield, if you would like to 
start by introducing yourself and your two 
colleagues, and then also just telling us, in a nutshell, 
what the NHS Confederation is? 

(Mr Elderfield) My name is Graham Elderfield and 
I am Chief Executive of the Isle of Wight Healthcare 
NHS Trust. Perhaps if I can ask my two colleagues 
to introduce themselves. 

(Mr Kerin) 1 am Mr Michael Kerin, the Chief 
Executive of Bexley and Greenwich Health 
Authority. 

(Mr Stock) I am Tony Stock. I am Head of 
Information Management and Technology at 
University College London Hospitals NHS Trust. 

(Mr Elderfield) The NHS _ Confederation 
represents both health authorities and trusts within 
the NHS, it is a body which has membership from the 
whole cross-section of the NHS and is very good at 
bringing together issues such as this one today, Sir. 


351. Thank you very much. Do you have a 
Chairman of the Confederation, and Secretary, as 
other organisations do? 

(Mr Elderfield) Yes. 


352. Are you the Chairman or a member of the 
Executive of it? 

(Mr Elderfield) 1 am not a member of the 
Executive, I am here in place of Stephen Thornton, 
who is the Chief Executive of the NHS 
Confederation. 


353. Thank you very much. That just helps us set 
the scene. Now, Mr Elderfield, in your submission, or 
the submission of the Confederation to us, you give 
a long list of difficulties facing the National Health 
Service with regard to the so-called millennium bug, 
you refer to the difficulties there will be with 
suppliers, with equipment, with finances, but you 
conclude: “it is feasible to address the vast majority 
of issues.” I wonder if you could let us know why 
your Confederation and youf member trusts feel so 
confident about this problem, as we get closer and 
closer to the year 2000? 


(Mr Elderfield) Chairman, the Confederation and 
its members believe that we will be ready by that time, 
because a lot of work has already started across the 
country in looking at the implications of the year 
2000 problem. Certainly, my own organisation is one 
of a number of sites that have been chosen by the 
NHS Executive to pilot and look at this in more 
detail; certainly, in my own trust we have had a 
project manager working for the past year, looking 
at the implications working through in a project 
management way to all of the issues contained within 
this problem. And, therefore, the evidence that the 
Confederation have had to date is that whilst we do 
not underestimate the considerable amount of work 
that will be needed between now and the year 2000 we 
believe that the NHS will rise to the challenge. 


354. When you look at the various problems, and 
I do not wish in any way to trivialise anything that 
happens in the National Health Service, but it 
possibly could be argued that if some supplies came 
in two or three days early, or some supplies even 
came in one day late, that might not matter too 
much. You could possibly even argue that if there 
was something wrong with a computer system, and 
some of the letters going out to patients asking them 
to come in for elective surgery were a little delayed, 
unfortunate, of course, and it may not be too 
efficient, but it is not life threatening. The thing that 
is life threatening is if equipment and machinery 
suddenly fail and then there is an alert, and that is life 
threatening. So I am not trivialising anything, but I 
am saying some things are life threatening and other 
things are not. Have you prioritised your work, to 
make sure that the life threatening ones receive 
maximum attention at the earliest possible time? 

(Mr Elderfield) Certainly, speaking for my own 
trust, we have been working through, looking at not 
only just systems and computers but also the 
important area which you have just touched on, that 
of medical equipment, also questions within estate 
management, and we have been starting to, really, in 
a priority way, look at each of these issues and tackle 
it; we have been starting to make sure that all of our 
inventories of assets are up-to-date so that we can 
actually work through each of these areas. I think the 
main thing that trusts like mine will have to do is 
undertake very effective risk management, because 
this is what this is about, it is a risk management 
problem for the NHS, and we need to have in place 
contingency plans to ensure that none of the things 
that you have touched on, Chairman, will happen. 

Chairman: Thank you very much indeed. 


Dr Jones 


355. I would like to ask about costs. In your 
submission to the Committee you gave some sample 
costs; now I appreciate that all this is very difficult, 
but we asked the Clerk to multiply those up, and that 
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gave costs anything between £67 million and £670- 
odd million, with a mid point of £371 million. What 
sort of money are we talking about, do you think, 
because we have had various estimates put forward, I 
understand the NHS Executive is talking about £200 
million, but there have been other, recent 
publications, suggesting it is going to be more like 
£500 million or £600 million? What is your view of 
the position, and what effect is it going to have on 
your budgets, as I understand no additional finance 
has been allocated? 

(Mr Elderfield) The short answer really is that at 
this stage the Confederation does not know precisely 
what the costs will be; however, we know that trusts 
and health authorities are required by 31 March of 
this year to have produced their plans, undertaken 
their inventories and to have put cost estimates to the 


centre on what it will be. I can speak only of my own- 


region, the South and West Region, where we have 
been looking at this, and we have had already SO per 
cent of health authorities and trusts submitting 
evidence back to us, and the costs for just our region 
alone, and that is only sort of half of the 
organisations, is in the region of £30 million. So I 
think certainly we will be in a position, as a 
Confederation, to have a more accurate figure at the 
end of March, which is when the NHS Executive 
have asked all health authorities and trusts to be ina 
position to report back to them on the financial 
implications of this. To come to your second 
question, about the effect on budgets, it is of concern, 
I think, to the Confederation and to health 
authorities and trusts that at the moment this 
problem is to be done with no extra funding, and that 
is an issue that certainly is of concern to myself and 
to my colleagues. And I think one of the things we 
will need to do is think very carefully about the 
priorities for the Health Service in the run-up to the 
year 2000. 


356. Where you have got that figure of £30 million, 
what is the budget of the organisations that 
collectively have costed up the problem at £30 
million: any idea? 

(Mr Elderfield) Unfortunately, I have not got that 
in the breakdown that I have got in front of me, but 
I could certainly provide that to the Committee as a 
written answer. 


357. Would you care to hazard some kind of guess 
for the overall costs, or will we really have to wait till 
31 March? 

(Mr Elderfield) | think it would be wrong for us to 
really give you a figure today, which could be 
misleading at this stage because of the fact that we 
have only got really half of the plans, certainly in my 
region, that have been submitted. 


358. Are people going to be able to cope with the 
£30 million in your region? 

(Mr Elderfield) 1 think it is important to 
understand that what we will need to dois really look 
again at our capital programmes, look again at what 
schemes will have to slip or change in order that this 
becomes a priority. Money will need to be diverted 
into sorting this problem, but it will be at the expense 
of other projects that we would want to have spent 
the money on. 
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359. You have suggested that private finance might 
be an option; is that realistic? 

(Mr Kerin) 1 have been asked to answer that one. 
I think, at this stage, it is not an option. In our area 
we have a fair amount of experience of private 
finance initiatives, and I suppose the key thing that I 
would say about them is that they work for very large 
schemes, not for smaller schemes, and you have to 
allow time for the analysis and negotiations to be 
done, and on the year 2000 problem we are up against 
a very finite deadline. So I think, in terms of 
contingency and risk analysis, we are looking for 
mainstream funding. 


360. You talked about the finite deadline; is it not 
worrying that here we are in February 1998 and the 
NHS cannot even give us any costs of actually 
dealing with the millennium compliance? Does that 
not shake, or it certainly shakes my confidence in 
your assumption that we will win through in the end? 

(Mr Elderfield) \ think, Chairman, that, as I said 
really in my opening remarks, the NHS will be ready, 
but there is a significant amount of work, which we 
do not underestimate, that will need to be done in 
this time. 


361. How can you say you will be ready when you 
do not even know the amount of work or the costs 
involved? . 

(Mr Elderfield) Because I have some confidence in 
the fact that we do have in place plans being 
developed, deadlines which will be met, and certainly 
the evidence that I can draw from being a member of 
a regional group looking at this problem is that the 
response has been very positive from health 
authorities and trusts. 


Mr Beard 


362. Just following the question Dr Jones asked, 
are you planning that the remedy of this will be from 
within National Health Service staff? 

(Mr Elderfield) \ think that, at the moment, as I 
understand it, there will be no new monies for this, 
therefore we will need to look at the budgets that we 
currently spend on information management and 
technology, on the capital allocations that health 
authorities and trusts get, and we will need to 
reorganise our priorities, in order to make the 
necessary funds available for this, but some schemes 
will not go forward as a result of that. And I think 
what certainly the Confederation will be looking for 
is perhaps a greater clarity about what the priorities 
are for next year; for example, we have an initiative 
to move towards single-sex wards in hospitals across 
the country, now that is going to cost money, we 
cannot do that at the same time as doing this sort of 
work in replacing major systems, replacing 
computers and other medical equipment, so some 
choices will have to be made about this. 


363. What other activities are likely to be deferred 
or postponed? 

(Mr Kerin) If | could make two points. The first is 
that, clearly, the NHS is not a closed system and we 
are dependent on action being taken by others as well 
as action being taken within the NHS as well. 
Turning to your other question, my particular 
interest, I suppose, in being here is from a health 
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authority in relation to primary health care, and, in 
effect, the costs of addressing this issue in primary 
health care, certainly for general practice, would 
come from the earmarked funds for general medical 
services, which means it would take higher priority 
than the recruitment of extra practice nursing staff, 
premises developments, training, computers. 


Chairman 


364. I would have thought, Mr Kerin, that if your 
Confederation did not exist the 2000 problem would 
have been a very good reason for making it exist, to 
co-operate together, share your information and 
pool resources; there is no point in inventing the 
millennium bug 50 times in the course of this small 
island. To what extent really are you getting co- 
operation, and ideas from Glasgow are coming down 
into Kent, and ideas from Newcastle are going into 
Exeter, to what extent is this happening? 

(Mr Kerin) Certainly, in our area, and I am from 
the South Thames Region, there is a lot of 
collaboration going on between people in various 
parts of the region, and linking in to other systems 
both through, as it were, human networks and web 


networks, and what have you. The issue is that one 


can learn from the experience of others but one has 
actually got to do the analysis in one’s own area to 
find out precisely what systems are in place, 
particularly in primary care, where in our area there 
are 13 different systems being used by GPs, and 
working across that. 


365. But “not invented here” is not alive and well, 
I hope? 

(Mr Kerin) So do I, because it obviously adds to 
the cost, the time and the complexity. 


Mr Jones 


366. I have just been extrapolating the £30 million 
for half of the South and West Region; nationwide, 
you are talking hundreds of millions of pounds to put 
this right. Can you give us a bit more feel of what that 
is going to mean for primary care patients, are you 
going to be firing doctors and nurses in order to pay 
programmers and engineers? 

(Mr Kerin) If I can answer that, the answer is no, 
because the way that primary care is funded the 
money for GPs comes from a different pot. The pot 
of money is a fund, as I said before, specifically for 
practice premises, computers and training. So that is 
the area that the relative priorities are between, in 
primary care. 


Mr Beard 


367. Could you give us an indication of where you 
think patients will see the effects of this diversion of 
funds in this away from the normal run of things in 
the National Health Service towards the millennium 
question? 

(Mr Elderfield) 1 think, Chairman, it really goes 
back to the example I have sense that we certainly 
will be looking to spend mohey from our capital 
budgets to put right some of the problems we have 
identified, and that will mean that some of our 
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upgrading of wards, some of the schemes that we 
have set aside to buy equipment, will stop, in order 
that money is then diverted into solving this problem, 
and it is in those sorts of areas that I think the public 
will notice a difference. 


368. Are you confident that, given the scale, as has 
been said, that appears likely to come out of your 
gathering together of the estimates in March, this can 
be tackled from within your own resources, or are 
you going to have to depend on recruiting people 
from outside? 

(Mr Elderfield) Perhaps I could ask Mr Stock to 
talk about the recruiting people aspect. I think that 
once we have a clear idea of what the implications 
financially are for the Health Service, and, as I say, 
this will be at the end of March, we have to have a 
discussion with the NHS Executive and with the 
Government about whether or not there are 
sufficient resources in the NHS in order to put right 
the problem. And it may well be that additional 
resources will have to come in to the Health Service 
in order to help us with this problem, otherwise we do 
need to have a clear steer, I think, from Government 
on the issues really that we should be dealing with. As 
I say, we cannot implement one policy of moving to 
single-sex wards and the costs that go with that at the 
same time as trying to fix this problem. I think we will 
need some leadership here. 


Dr Williams 


369. Can I just probe a little the way that that £30 
million figure was arrived at; these were estimates by 
individual trusts about how each should tackle its 
own problems, is it, and then just the sum total of 
each of those estimates? 

(Mr Elderfield) That is correct, Chairman, yes. 


370. There is no economy of scale built in, or co- 
operation, collaboration, and because you are 
tackling the same problems, effectively, in 10 or 20 
different units, therefore if you all work together we 
work out a way of doing this more cheaply? 

(Mr Elderfield) There is some working together. I 
think the problem we have got in the Health Service 
is that health authorities’ and trusts’ development of 
information management and _ technology has 
progressed at different rates, some hospitals have got 
very sophisticated systems, others have not, and that 
is why we see a difference in the returns that we have 
had so far, because some have got systems in place, 
others have not, and, therefore, the costs of replacing 
or repairing those systems will differ across different 
trusts. But I would like to reassure the Committee 
that certainly there are, at the regional levels across 
the NHS, groups coming together to share best 
practice, to learn from each other, so that we can 
really understand the nature of how to tackle the 
problems. 


371. A couple of weeks ago we had Shell giving 
evidence to us, and their programme was worked out 
in detail with collaboration right across the UK and 
internationally, and this is a private organisation that 
knew the goal that it was going for and it has built in 
efficiencies then. But the NHS has become too 
disparate really for that kind of central formula for 
the regional centres to take control of this problem? 
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(Mr Kerin) I think that the first thing to say is that 
since 1948 the NHS, while it has been one entity, has 
never been one organisation, because one of the 
keystones of the NHS is general practice, each of 
whom is a_ separate, independent business, 
contracting to the Health Service and ultimately 
responsible for their own systems. And it reinforces 
the point that Mr Elderfield has already said, one 
cannot give a unit cost even for a GP practice because 
it will depend on their size, it will depend on the 
systems that are in place. And so I do not think it is 
practical to take that kind of centralised approach, 
let us say, Shell could take by being one company, 
through the system, because we are actually relating 
to independent contractors as well as people who are 
managed within NHS bodies. 


372. Can I ask about the regional centre, have they 
convened something like day conferences, or schools, 
pulling in representatives from each of the trusts, to 
pool that sort of information that each of you has 
acquired? 

(Mr Elderfield) Yes, indeed; certainly, speaking for 
the South and West Region, where I am a member of 
the regional group that is co-ordinating this, we have 
already had regional events during November and 
December, with specific meetings planned for health 
authorities and trusts. We have also had meetings 
with emergency planners, to look at the whole 
emergency planning process that needs to be in place, 
because this affects ambulance services as well as 
hospitals and GPs. We have also undertaken training 
in project management, which this is important for, 
in risk management and in contingency planning, 
because we want everybody to be ready for this. We 
have also, through the regional office, undertaken 
performance management arrangements whereby 
the regional office is now monitoring how quickly 
each of the health authorities and the trusts are 
getting their plans together so that there is an 
effective co-ordination at the regional office level to 
take this forward. 


Mrs Spelman 


373. What exactly is the remit of the NHS 
Executive Year 2000 Steering Group, and does it 
have the power to coerce trusts and authorities to 
take action? 

(Mr Stock) The way that the year 2000 problem 
has been devolved in the NHS as a whole has been to 
specifically put the responsibility with the chief 
executives of the health authorities and the trusts, 
and that was promulgated specifically in an 
Executive letter last October. The Steering Group, 
which is a fairly recent foundation, has effectively 
been taking the role of advice and dissemination of 
information. I cannot specifically say whether it has 
the Executive power of compulsion without referring 
to NHSE; we could give you an answer on that 
specifically. If I might just say that, the way that the 
central organisation has been perceived from the 
trusts, over the past 12 to 15 months there has been 
particular encouragement from those trusts which 
had made some headway and had recognised the 
problem early, to try to seek the economy of scale 
that one might get by sharing the task, either 
nationally or regionally, and that is now manifesting 
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itself really through the regional groups, as Mr 
Elderfield has described for his region, we have found 
a similar approach now emerging in North Thames, 
but only after some considerable pressure from the 
detail of the individual trusts. 


374. Does it have a role of monitoring what 
progress is being made, and is it likely to publish 
those findings? 

(Mr Stock) It does have a monitoring role, it is 
publishing the findings, it has an active presence on 
the worldwide web, it has a website, which is being 
updated fairly regularly, and to which the regional 
offices are reporting the specific progress. 


Chairman 


375. Thank you very much. Just before we go to 
Mrs Curtis-Thomas, can I just go back, please, to Mr 
Kerin on one point. I think it was his answer to Mr 
Jones, when a question was asked, does it mean as a 
result of finding money for this 2000 millennium bug 
that there may be fewer doctors and nurses, you said, 
no, because it comes from a different pot. But, since 
we learned. from the early questions from Dr Jones 
that there was not a pot for this 2000 millennium 
problem anyway, the money has to come out of some 
other pot, somewhere, so, if it is not the doctors and 
nurses pot, it may be the pharmaceutical pot, or the 
bed-linen pot, or the building maintenance pot, it has 
to come from some pot; which pot does it come from? 

(Mr Kerin) That is correct, it has to come from a 
particular pot, and that pot covers the expenditure in 
general practice for practice support by way of 
computers, training and premises development. 


Dr Jones 


376. But that was just for the general practice? 
(Mr Kerin) That is for general practice problems, 
yes. 


377. What about the rest of the NHS, what about 
doctors and nurses in the rest of the NHS? 

(Mr Kerin) Sorry, I was being asked about general 
practice and making it clear. 


378. Yes, I know you were. I am now widening the 
question? 

(Mr Kerin) I will then pass that back to Mr 
Eldertfield, because I think he has already answered 
that, in relation to the relative priorities around the 
use of capital funds, and the way in which it would 
have to be spent on this activity rather than updating 
hospitals. 


Chairman 


379. We do not wish to pin you down to the last 
penny; what we are interested in, of course, is that 
patients are not going to suffer directly. It may be the 
rooms are decorated less frequently, or sheets are 
used for one month longer, or something, but there 
will be some consequence. The point is, without 
going too deep into this, patients will not suffer 
directly but there has to be a knock-on effect 
somewhere, because you are finding money for this 
problem that was not budgeted for; is that correct, 
basically? 
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(Mr Elderfield) That is correct, Chairman. 

(Mr Kerin) Yes; and the way that the analysis has 
been done is identifying those things that are crucial 
to patient care as opposed to those things that are 
desirable. 


Mrs Curtis-Thomas 


380. I am interested, first of all, to go back on a 
number of observations that you have made so far. 
You asserted, Mr Elderfield, that you had a project 
manager who had been responsible, presumably, for 
a risk analysis within your own hospital, and 
subsequently Mr Stock went on to say that the 
requirement to carry out the analysis was given to the 
hospitals last October; is that correct? 

(Mr Elderfield) That is correct, Chairman. 


381. So last October was four months ago, and 
since that requirement you have undertaken a risk 
analysis within your hospital and so has the authority 
in your area? 

(Mr Elderfield) That is correct, for my own trust, 
yes. I think Mr Stock needs to answer for his own 
trust. 

(Mr Stock) Indeed, we had already carried out the 
preliminary analysis and assessment of the problem 
at our trust by about the middle of last year. 


382. Okay; but, nevertheless, in your area, it was 
last October. So the exercise has been concluded, or 
is ongoing, in four months? 

(Mr Elderfield) It is ongoing still, yes. 


383. And the consequence of that is a potential 
budget of £30 million? 

(Mr Elderfield) Chairman, if I could say, the £30 
million that I have quoted is the returns we have had 
from across the region, including my own; for my 
own organisation, we are currently looking at 
around £600,000, as a trust, that is the implication for 
us locally that our risk analysis has identified. 


384. Let me take you then a little further. Having 
identified that you have an individual involved in this 
particular exercise, indeed there are significant 
implications for the equipment that you utilise, in 
terms of delivering patient care, what resources do 
you have available to you now to effect the 


modifications of that equipment to ensure 
compliance with the year 2000? 
(Mr Elderfield) What we are doing is 


systematically working through each of the areas, 
Chairman, and if it involves suppliers the project 
manager is engaging those suppliers in discussions 
about how a piece of equipment or a particular 
supplier can be made compliant in the timescale that 
we are working to. So this process is very much an 
ongoing one in my own local trust, as I would 
imagine it is for trusts and health authorities across 
the country. I can only speak, as I say, for my own 
organisation. 


385. Could I ask you then, you have referenced 
third party suppliers and you have also indicated a 
timescale for compliance, what is the timescale for 
compliance that you are looking at? 

(Mr Elderfield) Perhaps Mr Stock can answer that. 
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(Mr Stock) The required timescale for compliance 
which was set out in the Executive letter was the end 
of this year, 1998, 31 December. So the ideal target 
which all trusts and health authorities have to report 
against is that their systems should be fully compliant 
by that date, or that there should be clear indications 
of when, indeed, they will be compliant. 


386. Just to recap then, so that I am not confused, 
we only have budget estimates for the potential cost 
of the compliance exercise, we are not terribly sure 
where that money is coming from at this time, and we 
then have approximately six months in which to 
enact the compliance project plans; is that right? 

(Mr Elderfield) That is correct, Chairman. 


387. Let me now just take you finally to my last 
question, which is, we have already referenced the 
primary care suppliers, or the primary care aspect of 
the National Health, but, of course, there are other 
agencies and other third parties with whom you 
work, notably social services, and you have already 
referenced the ambulance services. Given that you 
have a dialogue going on with some of your 
suppliers, how have you ensured that the continuity 
of care for those individuals that are external to a 
hospital environment, that are very much an integral 
part of primary care and social services, is not 
jeopardised by your planning process? 

(Mr Kerin) Certainly, in our area, we have a Joint 
Information Strategy Group, that includes the health 
authority, local trusts, local authorities and 
representatives from the GPs, to look at the world in 
the round, and this is clearly one of the important 
issues that we are addressing with them. 


388. Just for clarification, does that include 
members of the social services department? 

(Mr Kerin) Yes. 

Chairman: I wonder if I could just interrupt there, 
because we are running late, and I have already 
apologised for that. The Minister, the Chancellor of 
the Duchy of Lancaster, follows us. I have tried to 
point out to him that we are running 15 minutes late . 
and would that be alright; he does not mind us 
starting late but he has to still finish at the same time. 
So we are going to have to finish in about 6 or 7 
minutes time. My comments are addressed more to 
the Committee than they are to the witnesses. I hope 
the Committee will note that. Dr Jones, you have a 
quick question, then Mr Atkinson. 


Dr Jones 


389. Just very quickly, in dealing with all this, what 
are the staffing resource implications? I presume that 
their pay is limited by the general pay increases in the 
public sector. Is there a problem with staffing 
resources, are you worried about people being 
poached; if, at the end of the day, market forces 
reign, are we not going to see that the City gets its 
millennium compliance but the NHS does not? 

(Mr Stock) Yes, that is obviously something of a 
consideration, although perhaps our own 
experiences indicate that it may not be quite so harsh 
as it might appear. Perhaps surprisingly, a large 
number of certainly internal IT staff in the NHS are 
very loyal to the Service and do not find an attraction 
in working outside the Service. More specifically, 
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although there are technical considerations, in terms 
of fixing problems in software, as I think Mr 
Elderfield said right at the beginning, much of the 
issue is a risk management issue, and the sort of staff 
who are required to actually take this work forward 
are effectively good project managers, and there does 
seem to be a reasonable pool of available people to 
take on secondment, in our experience, but I can only 
speak specifically for our own region, but that is 
within London. 


Mr Atkinson 


390. A Professor Mike Smith, from St 
Bartholomew’s Hospital, recently produced a report 
which says: “Millennium failures in the Health 
Service are likely to result in between 600 and 1,500 
deaths, and there are 50,000 drip-feeds, all of which 
need recalibration, in the NHS, I understand.” My 
question is, how great is the risk that failures in 
equipment as a result of this problem will put 
patients’ lives in jeopardy? 

(Mr Stock) The best evidence that I have had, from 
my Medical Physics Department, who have looked in 
considerable detail at medical equipment, is that the 
risk 1s not as exaggerated as has been reported in such 
quarters as you have indicated. Nevertheless, we do 
recognise that this is a serious issue. Perhaps to give 
you an idea of the scale of this, in our own trust we 
have identified and inventoried some 7,000 pieces of 
medical equipment, of which we believe about 200 
alone, 200 only, have a true date function in. Many 
pieces of medical equipment have some sort of 
elapsed time capability in them for indicating that a 
recalibration is due, but it is not a true date function; 
and, out of the 200, or so, pieces that have date 
functionality, indications are that the majority of 
them are already compliant. There is similar evidence 
from the United States on that basis as well. 


391. But there are bound to be problems, and your 
memorandum refers to contingency planning. So 
what is the contingency plan for a hospital trust that 
cannot become compliant in time; will it have to 
revert to manual systems, will their people be trained 
for this, and will it restrict the number of operations 
it performs, or perhaps even result in the closure of 
beds? 

(Mr Stock) Possibly any or all of those measures 
may be necessary. I think it is fair to say that at the 
moment the majority of trusts will be moving into the 
detail of the contingency planning phase; certainly, 
my own trust is about to do that, we are about to 
work across the region, which picks up one of the 
points that Dr Williams raised before about co- 
operative working, and we would set out to identify 
appropriate plans in detail. 

Mr Jones: You say in your memorandum that 
many suppliers have not yet issued statements 
regarding the compliance of their products. Would 
you like to give us examples of responsible suppliers 
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and manufacturers who have assisted the NHS, and 
would you like to name a few names of those who 
have not? 


Chairman 


392. This is a delegated question, Mr Stock. Mr 
Elderfield is very happy for you to answer this one? 

(Mr Stock) 1 think, Mr Jones, that might be seen as 
rather a leading question, but, certainly, the primary 
suppliers of major administrative and health care 
software in the acute sector have been working, in my 
view, quite well with their customers; like most large 
organisations, they have the interest of remaining in 
business and having happy customers. We, at 
UCLH, are seen, as one of our suppliers described us, 
as an “aggressive” trust, in terms of putting the 
pressure onto our suppliers; we think we have been 
getting good responses from the major suppliers and 
we have not identified any who have in any way been 
at all recidivist about it. 

Chairman: Thank you very much. The final 
question, in 30 seconds, from Mr Beard. 


Mr Beard 


393. We have heard from the private sector that 
contractors who are not able to assist them in 
guaranteeing compliance of their equipment they will 
not do business with in future; why does not the 
Health Service do the same thing? 

(Mr Stock) I think that is certainly something that 
will be looked at as a serious consideration. As I say, 
our experience at the moment, and we have been 
working with some 20 or 30 key suppliers, is that we 
have not encountered that sort of situation. 

(Mr Kerin) I think, in primary care, we are finding 
that that is actually happening, that some of the 
suppliers will be going out of the market for that 
very reason. 


Chairman 


394. Thank you very much indeed; what 
marvellous co-operation. It is five to five, exactly the 
time I wanted to finish. Gentlemen, Mr Elderfield, 
may I thank you very much indeed for coming along 
this afternoon; sorry we had to speed up, our fault 
that we are late, not yours, but it has been very, very 
helpful. There is one answer, I think, you are going 
to write and let us have, is there not? 

(Mr Elderfield) Yes, that is true, Chairman. 

Chairman: And would you please give our 
compliments to Ms Diane Milan, who was not able 
to be with you this afternoon, maybe we will meet her 
some other time. Thank you, gentlemen, very much 
indeed. 
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Supplementary Memorandum submitted by the NHS Confederation 


The Committee clearly realised the scale of the challenge facing the NHS. We would have liked the 
opportunity to discuss the support the NHS is getting from government and what NHS organisations need. 
Our members feel the rate of support from the Government was too slow and we still need more recognition 
of the problem and support from the Department of Health. 


In particular, progress would be aided by stronger government pressure on suppliers, pressure on the 
Medical Devices Agency to provide detailed guidance, development of generalised contingency plans, both 
within the NHS and with partners, and better co-ordination by the NHS Executive Regional Offices. 


The NHS will need additional resourcing because of the strain on budgets due to coping with Year 2000. 
The opportunity costs implications are clearly that every pound spent on Year 2000 is not available for patient 
care. At the very least the NHS needs 3 per cent real growth each year. Once trusts and health authorities 
have submitted detailed project plans we will collate the overall cost of coping with Year 2000 and highlight 
the opportunity costs for the NHS. 


24 February 1998 


Memorandum submitted by The Chancellor of the Duchy of Lancaster 


1. The Central IT Unit (CITU) supports me in carrying out my overall strategic and co-ordinating role in 
relation to the approach to resolving the Year 2000 problem taken by central government departments and 
agencies. My role includes giving impetus to the action by departments and agencies, providing guidance 
where necessary and reporting to Parliament on the overall state of preparations. I also have Ministerial 
responsibility for action by the Office of Public Service and its agencies. The principal responsibility for 
ensuring that their computer systems are Year 2000 compliant rests with individual departments and 
agencies. They are also responsible for ensuring that organisations in the wider public service sectors which 
they sponsor (such as local authorities, health authorities and non-departmental public bodies) understand 
their responsibilities. 


2. This memorandum is concerned with my, and CITU’s, responsibilities, and does not address the private 
or wider public sectors. 


(i) THE NATURE, MAGNITUDE AND IMPLICATIONS OF AN INABILITY TO MANAGE THE DATE CHANGE 


3. The threat to central government and agencies is very serious but varies according to the nature of each 
organisation. Critical government functions depend on mainframe computers (eg benefits payments, 
taxation); government systems and buildings may contain many embedded processors; and government as a 
whole is increasingly dependent on personal computers. 


(ii) THE EFFECTIVENESS OF ACTION WHICH HAS ALREADY BEEN TAKEN TO AVERT PROBLEMS IN GOVERNMENT 


4. In my statement to the House of Commons on 27 November (copy attached), I said that I had received 
plans from all departments and agencies showing how they were tackling the problem. On the basis of those 
plans, all have work in hand and scheduled for completion in time—many by December 1998, a majority by 
March 1999 and a small number later in 1999. Some Departments will in general give priority to correcting 
business critical systems and may leave systems of minor importance until later. The Government’s policy is 
that the cost will be met from within planned allocations, and the evidence from the plans is that almost 97 per 
cent is so covered. Overall, my assessment was, and remains, that government has established the measure 
of the problem-and set in hand plans which are realistic and achievable, but the bulk of the actual remedial 
or replacement work is yet to be done, the timetable is tight and there is little margin for error. 


(iti) THE ROLE OF GOVERNMENT IN RAISING AWARENESS 


5. Immediately after taking office, I wrote to all Ministerial colleagues in charge of departments to ensure 
that the new Government took concerted action. I asked to receive, as soon as possible after 1 October, 
detailed and costed plans, showing how their departments and agencies were tackling the problem. The plans 
were placed in the Library of the House and published on the Internet. I also wrote to Ministerial colleagues 


" i November to ask for additional information on embedded systems, contingency plans and staffing and 
skill issues. 
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6. Departments are supported on Year 2000 by CITU and the Central Computer and Telecommunications 
Agency (CCTA) who advise, disseminate best practice and keep in touch with industry and other 
practitioners. CITU and CCTA have set up an inter-departmental group on Year 2000 issues, and have been 
in regular contact with DTI, NAO, Taskforce 2000 and now Action 2000, the Computing Services and 
Software Assocation (CSSA) and the private sector so as to keep themselves fully up to date. 


7. As IT announced on 27 November, I am chairing an inter-departmental Ministerial group to co-ordinate 
and drive forward the action for which central government departments and agencies are responsible. 


(iv) THE EXTENT TO WHICH NEW SYSTEMS AND SOFTWARE ARE “MILLENNIUM COMPLIANT” 


8. Between April 1996 and September 1996, the CCTA held a series of workshops with Departmental 
Officials to ensure that the contractual implications of Year 2000 compliance were fully understood by 
procurement officers. Following this work, in September 1996, a standard set of contractual conditions was 
published by CCTA for use by Departments in any IT procurement. Departments and agencies have been 
asked to undertake spot checks of new systems and software to ensure that they are genuinely compliant. 


(v) THE DEVELOPMENT OF CONTINGENCY PLANS 


9. I have asked Ministerial colleagues to ensure that the contingency plans in place to cope with major 


systems failures are adequate to deal with any unforeseen Year 2000 processing problems. 


(vi) THE LEGAL IMPLICATION OF DISPUTES OVER LIABILITY 


10. CITU has no remit in this area. Legal advice is available to departments and agencies through CCTA, 


and through departmental legal advisers. 


15 December 1997 


Examination of Witnesses 


RT Hon Dr Davip CLARK, a Member of the House, Chancellor of the Duchy of Lancaster, MR MARK 
GLADWYN, Deputy Director of the Central Information Technology Unit, Office of Public Service, were 


examined. 


Chairman 


395. Chancellor, we apologise for running ten 
minutes late, we have managed to pull back five 
minutes, but we had a rather extended private 
meeting at the beginning, and we did try to get a 
message to you, I hope you received it? 

(Dr Clark) You did; thank you very much. 


396. And I do understand that you still have to 
leave at the set time, so we will be as quick as we can. 
May I just say, on a personal note, it has taken 15 
years for Dr Clark to come face to face with Dr 
Clark, and I do not know if I should start with the 
word “snap”, but I do start by welcoming you most 
warmly to this Committee, and look forward to the 
help you can give us. Dr Clark, I believe that you do 
wish to just make a short opening statement? 

(Dr Clark) Yes. It is a pleasure to be here, Dr 
Clark. Can I just introduce Mark Gladwyn, who is 
my principal adviser on these technical issues, he is 
Deputy Head of the Central Information 
Technology Unit of my Department, and Mark will 
certainly help me, and I suspect help us all, with some 
of the more technical questions. Can I say that I 
really thought it was not appropriate to make a 
statement, I think these Committees are much better 
if we treat them as dialogues and then you can 
actually ask me.the questions, and hopefully I will 
give you the answers that you want to hear. But 
perhaps I can just make one general point. My 
responsibility overall is to see that central 


government departments, and their agencies, are 
aware of the millennium compliance problem and 
that they have realistic plans and costed plans to try 
to deal with that problem; and the operational 
responsibility for meeting those plans rests with the 
departments and the Secretaries of State concerned, 
as indeed they are responsible directly for the public 
departments which they sponsor. And I thought it 
might just be helpful to put that down as a marker 
right at the beginning. 


397. It certainly is, Chancellor; thank you for that. 
But, having accepted that and fully accepted that, I 
wonder if I could just tempt you with one question, 
because we are finding out the ways in which the 2000 
problems are facing government departments and we 
are also finding out ways in which they are affecting 
the private sector. I wonder, from your standpoint, 
while you are not responsible for the private sector, 
whether you have been able to observe any principal 
or major differences between the government sector 
problems and the private sector problems? 

(Dr Clark) | am very happy to comment on all 
these, because clearly the Government has a 
responsibility and I do indeed sit on the MISC 4 
committee, which is the Cabinet Committee the 
Prime Minister has established; in fact, the terms of 
reference are to drive action across the public and 
private sectors, to ensure that the national 
infrastructure is not damaged by the failure of 
electronic systems relating to the year 2000. So, 
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clearly, there is some responsibility. And I meet 
regularly with IT specialists, and indeed discuss these 
issues with Don Cruickshank, I have actually 
discussed it with Robin Guenier and a great many 
other people. And, as I see the situation, we have 
things to learn from the private sector, and I suspect 
the private sector has lessons to learn from us, and 
certainly, as we draw on and try to make our plans, 
we are conscious that in some cases the private sector 
is ahead of us and we are also conscious that in other 
cases they are behind us; so there is an interrelation. 
And I make the other point, that a great deal of the 
central government compliance work is actually 
contracted out, in fact the majority would be, to 
private companies, so we cannot, in fact, cut 
ourselves off from the private sector entirely, indeed 
I do not know what the percentage is but I think a 
very large percentage would be private contractors. 


398. And just a final question from me, before we 
go to Mr Jones. Do you find, Chancellor, that there 
is goodwill in attempting to solve this problem, there 
is not jealousy, or “I have solved the problem, you 
haven’t” and “Aren’t I good and you're not?”; is 
there really goodwill to try to solve this problem, 
which has only another, what, 22 months to go 
before it hits us? 

(Dr Clark) I think there is. I have taken the view, 
in a sense, that it is no use looking for winners or 
losers, or goodies or baddies, and actually it is no use 
on the one hand being over complacent or being 
alarmist, the problem is that in 100 weeks time, or 
whatever it is, less than that, the problem has got to 
be dealt with and the problem has got to be tackled. 
And, equally, it is no use Government solving the 
problem if private industry has not solved it, because 
there has got to be an interface of the computers, and 
if one is compliant and the other is not we are in equal 
problems. So I have tried to approach it with good 
nature and good grace, and, I must admit, the 
response I have had from the private industry has 
been understanding and a willingness to work 
together. I think one of the problems is this problem 
of awareness. I hope that we are beginning to address 
it, and I was interested to see the statement in The 
Times, I think it was, on Monday, from Robin 
Guenier, from Taskforce 2000, who actually said 
that it was his belief that the awareness in Britain, 
private and public, was greater than in any other 
country in the world, and certainly that view has been 
expressed to me on a number of occasions. 


Mr Jones 


399. Chancellor, can I say that I am delighted that 
someone in the Cabinet has responsibility for this. 
You made a statement to the House in November, 
and you submitted a memorandum to us; could you 
give us an update as to what has happened since those 
two events? 

(Dr Clark) Yes, fine. Perhaps I could just remind 
you what I was basically trying to do on 27 
November. When I assumed office this was 
something that did concern me and I talked to my 
officials and we worked ou} a strategy. One of the 
problems is that the way Government has been 
structured is, as I indicated, whilst I have overall 
responsibility for seeing that the plans are in place, I 
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actually have not overall responsibility for their 
implementation. Having said that, if the thing does 
not work on 31 December 1999, people are not going 
to split hairs, and the Government is going to get the 
blame, and mea culpa, in that sense; so I accepted the 
responsibility in that way. Then, we wrote round to 
every government department, asking them to 
submit plans to us, detailed plans, of how they were 
going to cope with the problem, to do an audit and 
then also to put costs. When I got those results I 
reported to Parliament and, as you know, put the 
pages on the Internet and made them available on 
CD-ROM and also in paper. So all the plans have 
been there for people to see. I felt it was important 
that we were all aware of what happened to those 
plans, so I said I was going to revisit, every quarter, 
each department to ask for an update of their plans; 
we have done that, and I think the closing date for the 
responses is 18 February, or thereabouts anyhow, 
and once we have had time to analyse those I will 
report back to Parliament. I think it is very important 
that we are open about this and people can see what 
Government is doing; and what I find interesting is 
that, as I say, I have spoken to a lot of IT operators, 
and I have said to them all, “Look, we’ve been open, 
these are our plans, they’re very detailed,” with the 
exception of the MoD, for obvious reasons, “if you 
can find anything wrong that we are doing, please tell 
us.” Now I checked this morning; as of this morning, 
not a single person has contacted my office, the 
CITU, or our agency, to advise us of any point that 
they thought was wrong. So that has taken place. We 
have also established, as you know, the Cabinet 
Committee, I referred to MISC 4, and we have also 
got a sub-committee, which I chair, which actually 
looks at central government departments and 
agencies; we have had one meeting of that, we have 
one more scheduled in the near future, and what the 
purpose of that was, I felt, was to raise awareness 
with Ministers of their responsibilities within their 
departments. And I have also written round to all 
Secretaries of State, drawing to their attention that 
they have a responsibility for millennium compliance 
for the sponsored public bodies under their remit, so 
to speak, and asking them if they will do a similar 
exercise with the bodies for which they are 
responsible as I have done with central government. 
I would like to see as much of this in the open arena 
as possible, so we can check progress as we go on. 
Chairman: Thank you very much indeed. 


Mr Jones 


400. Just one small question. You mentioned the 
Ministry of Defence, and I have noticed that their 
submissions are brief and basically just say that they 
are going to be ready on time. As someone who wrote 
a couple of the systems that are still in operation at 
the Ministry of Defence, if you run into a spot of 
bother, let me know. Are your officials able to get in 
to the Ministry of Defence, just to reassure yourself 
that they are going to be ready; clearly, you can get 
into all the other departments, but is the Ministry of 
Defence slightly different? 

(Dr Clark) It is slightly different, and I am sure they 
will take up your job offer very quickly; the comment 
was made that we are not worried so much about the 
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chips in the computers of our missiles, it is other 
people’s missiles targeted at us that worry us 
perhaps. I talked to the MoD, because I actually 
thought, quite frankly, that just to shelter under the 
blanket of security, we all understand the security of 
live systems, and this sort of thing, but when you get 
the dental section, that they cannot give us 
information, for example, I thought that was 
stretching it. So they have agreed that they are going 
to look at the way in which they present the evidence 
in future, and I hope that will allow us greater 
transparency and ability perhaps to measure and test 
some of their systems, which are not so sensitive as 
others. So they have agreed at the meeting, and one 
of the advantages of the committee was that they 
agreed that they would address that problem. 


Mr Beard 


401. I believe, Dr Clark, you said you were 
monitoring this situation every quarter, that was 
your statement; how confident are you that all the 
departments are going to be ready in time, as a result 
of this? 

(Dr Clark) We actually have a schedule, which I 
hope you have got, we can certainly let you have, of 
all the departments, it is publicly available, and we 
will certainly let you have that. We estimate, on the 
figures, that 36 per cent of the central organisations 
have given completion dates by 31 December of this 
year, and a further 46 per cent, in other words, I think 
that is 82 per cent overall, by March 1999. That leave 
us with 14 per cent completion dates up to about mid 
summer 1999. So there are one or two very small 
departments have not given us target dates; some of 
these are not particularly sensitive, for example, 
Wilton Park, which is, as you know, the residential 
centre for the Foreign Office, they have no real 
problems, as they see it, they have just got normal 
PCs they use for operational purposes. So we have 
got the details, we will monitor them very closely that 
they are sticking to those sorts of timetables, and, of 
course, we are hoping also that it is not only a 
question of compliance but these systems are tested 
as well, tried and tested. So that is what we are hoping 
to do. 


402. Because we have just had evidence from a 
team representing the National Health Service that 
have not yet assessed the full cost of this for the 
Health Service nor the full range of skills or resources 
that might be needed to put it right. How many 
departments are in the same position as they appear 
to be? 

(Dr Clark) The central departments, I think, we 
have an idea, because we have got costed figures from 
them and a breakdown of it. They estimate that the 
total cost at this moment of time, for all the central 
government departments and their agencies, 
remember, we are not talking about other public 
bodies, is £370 million. I will not hold people to those 
figures, because the key thing is to make sure the 
problem is solved, and I believe those figures may 
well vary as time goes on; one has only got to, Mr 
Chairman, come back to your point about have we 
learned anything from private industry, one thing we 
have learned is that, as private industry has gone into 
the process, as they have gone into the testing, their 
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estimates of the cost, sometimes, have actually been 
under what they are going to be. So I would expect 
this figure of £370 million to vary as time goes on. But 
if you look at it and compare alongside the figures for 
the insurance industry and other industries, it is not 
really very much out of kilter, bearing in mind we 
employ about 470,000, we are not as computer- 
dependent as the insurance industry, I think they are 
talking about £500 million. So this figure does not 
seem very far out. But I do anticipate it will vary 
somewhat as time goes on. 


403. The evidence, again, for the Health Service, 
was that the money that was required would be found 
essentially from the capital programme, which would 
mean deferring quite a few capital projects; is this not 
going to have a juggle effect if the Government. is 
dealing with the costs in that way throughout the 
Service? 

(Dr Clark) 1 think there may be a greater problem 
with the non-central government departments. We 
have had a purchasing policy since 1996 that all new 
equipment is millennium compliant, and, indeed, 
following one of my reviews in October, I have now 
asked every department to do actually random 
testing of the smaller equipment; the mainframe 
equipment and all that sort of thing we can test very 
easily and we can test really in every case, but with 
PCs and things like that we are now doing random 
testing to make sure that the contractual agreements 
which we have had in place since, I think, September 
1996 are upheld. And, as you know, and Mr 
Gladwyn will come in here, if we need him, we also 
tried, in trying to meet the compliant problem, to 
make sure that we build in the regular replacement of 
PCs and other computer equipment as we go on; that 
has been part of solving the problem, so to speak. 


404. If, in the process of monitoring, you do come 
to the conclusion that a particular department is 
falling behind its timetable, what are the options 
available to you to cause them to speed up? 

(Dr Clark) I have no authority, in a sense, to force 
them to do it, except the authority (a) of publicity, 
which I think is quite important, and the policy of 
persuasion, in the sense I have been charged by the 
Prime Minister to address this problem. And I am 
pretty sure, I am confident indeed, that if we do find 
there are any departments falling behind, certainly 
my experts will be very happy to work with them to 
address the problem, to make sure that we do not fall 
behind. Because the key thing is not to apportion 
blame of any description but to meet the problem as 
of 31 December 1999. 


Dr Jones 


405. How do you really know that they are falling 
behind, are you reliant upon them to tell you that 
they have a problem, or do you take any steps 
yourself to monitor what is happening? 

(Dr Clark) In a sense, bearing in mind one is 
dealing with huge departments, if you take those like 
the DSS or the Inland Revenue, or something like 
this, you really are dependent upon the information 
which they provide. And I think that we have 
obviously got our own experts at the centre, and each 
of the departments has their own experts, and there is 


92 MINUTES OF EVIDENCE TAKEN BEFORE 


11 February 1998] 


[Dr Jones Cont] 

a fair cross-fertilisation of ideas and information and 
best practices, and I think that it would be very 
foolish, and I do not think it would happen, that any 
department would set out to deceive the centre, it 
would be very foolish, and I am sure they would not, 
because they would be found out very quickly. And 
that is why it was so important to get this massive 
audit of the 1,600 pages now of every department 
that we can measure against. 


Mrs Spelman 


406. Chancellor, in your memorandum you say 
that some departments are going to leave correcting 
systems of minor importance until after the 
millennium. Could you give us some examples of 
what you consider to be a minor system? 

(Dr Clark) Yes. The most obvious one are things 
like pocket calculators, it simply, probably, is not 
worth the while, well I would say it is not worth the 
while, actually to check if the pocket calculator is 
going to be compliant or not; in those sorts of cases, 
the easiest thing is to see if it works on 1 January 
2000, and if it does not buy a new one. That is almost 
certainly a cheaper way of tackling the problem. So 
that is a very clear and simple one. And I think there 
may be other things, where we just have normal PCs 
which are used purely for maybe correspondence; in 
cases like that, it really does not matter too much, as 
we are advised, if there is anything wrong with that, 
because the odds are, in any case, that it will be 
working on a two-digit time clock and it will just 
recognise 00. And if I am replying to you and it is 2 
January 00, you and I will read that as year 2000; if 
the computer thinks it is 1900 well there is no 
problem with that. So it is that sort of thing that we 
see as minor sorts of problems. 


407. Are there any departments or agencies which 
you have particular concerns about, and, if so, which 
are those; we have heard about your monitoring 
process, but what have you done to encourage those 
departments to make efficient preparations? 

(Dr Clark) We are at the stage where we have not 
had the first quarter yet even, so it is very early days. 
But one of the things that came out of the committee, 
with our sub-committee, and I am being very frank 
and honest with you on this, was that I was 
encouraged by the enthusiasm of my ministerial 
colleagues, and we are looking at ways if we can 
actually do some testing and checking of 
departments, indeed, I have volunteered my own 
department that we might just check that we have got 
it right. And that really was the spirit of the Ministers 
concerned, we are not trying to hide anything, we are 
not trying to prove anything, we are just trying to 
make sure the system works. So we are hoping, by 
doing some testing of departments, that we can make 
sure that the system is working, we are not trying to 


catch anyone out, we are just trying to make sure it 
works. 
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Dr Jones 


408. Sorry, who is going to do the testing? 
(Dr Clark) It will be the people at the centre here, 
basically; my people. 


409. So you are going out to sort of do random 
checks? 

(Dr Clark) And Ministers have volunteered this, 
yes. 


Dr Williams 


410. Does the Cabinet Committee and MISC 4, 
and IJ think you mentioned a sub-committee too, are 
there 2 different committees there? 

(Dr Clark) Yes, there are. Perhaps, Dr Williams, I 
have given you the terms of reference of the main 
committee, which the President of the Board of 
Trade chairs, the ministerial sub-group is to drive 
action across central government departments and 
agencies to ensure that Government business is not 
damaged by the failure of electronics systems relating 
to the year 2000. So ours is more specific on central 
government and the departments related to it, the 
agencies related to the central government 
departments. 


411. And the MISC 4 entails private industry as 
well? 
(Dr Clark) It does, indeed. 


412. There was a meeting in January, that was the 
first meeting; how often do you intend meeting 
during the course of the year? 

(Dr Clark) The general way the committee has 
been working is that we had the first meeting and we 
tasked various departments and various ministries to 
do particular sections of works, I am talking about 
MISC 4 here. And it has been reported in the paper 
accurately that most of the attention of MISC 4 has 
been addressing contingency planning, because, 
quite clearly, we have got to make sure nothing does 
go wrong, and if things go wrong before the critical 
date we try to address those, but we are aware that 
even things may go wrong on | January of the year 
2000; so we are looking at very basic things that the 
whole of life depends on, things like 
communications, like power supplies, and so on and 
so forth. So we will almost certainly do that at the 
strategic level. But also, at the more, if I could say, 
mundane level, we will certainly be looking at bodies 
such as the Consumers’ Association, we will perhaps 
do an audit of perhaps a certain number of houses, 
just to see how serious the problem is in the domestic 
scene as well, because nobody is really sure how it is 
going to affect the domestic scene, so to speak. So we 
will try to look at it at both levels. 


413. I am aware that you are, as an individual, 
especially computer literate and into word processors 
and lap-tops, and what have you. 

(Dr Clark) Red boxes. 


414. Yes, red boxes even. So, in a sense, you feel 
very committed to this programme, and I am sure 
that as well as your abilities come into this then it will 
get very high priority; but are there some other 
colleagues in the Cabinet that are not so computer 
literate, that will not give it the same priority and 
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drive that you do, and will their civil servants or 
permanent secretaries be able to sort of perhaps 
overcome their lack of computer knowledge? 

(Dr Clark) I have been very encouraged by the 
ministerial committees, because I did take the view, 
and I think it is right, that you had to attract the 
interest of Ministers; if you can get Ministers 
attracted by this, they will keep driving it on. And I 
think we have got the message through to them, 
because the basic point is, almost all the Ministers, if 
they do not use computers themselves, use them in 
their offices, and will be able to address the problem 
very personally, and they have been asking me 
questions, “Well, what happens to my PC in the 
office?” and it is that way of trying to engage their 
publicity. And, I must admit, the idea of doing some 
random testing, which Dr Jones referred to before, 
actually the idea came from one of the other 
Ministers, “Why don’t we try to do this sort of 
thing?” and I am quite happy for my department to 
be guinea-pigs in this one. So I think there is very 
much a great deal of willingness; because we realise 
this has got to work, it is not a party political issue, 
it has just to work for our country. 


Mr Atkinson 


415. Chancellor, you have just told us that the £370 
million figure which you announced on 27 November 
to be spent over two and a half years might vary, and 
that is understandable; but that figure has been 
greeted by experts as being totally inadequate. They 
have pointed out, for example, that the experience in 
many other organisations has been that their 
compliance costs have risen as the projects have 
progressed, and the IT industry has this reputation of 
escalating costs never being within budget. So have 
you allowed for this experience, and how confident 
are you that your departments will be within that 
overall budget of £370 million, that you say is subject 
to only slight variation? 

(Dr Clark) Mr Atkinson, I know your work in this 
field, and I think I did make the point before that we 
had tried to learn from the private sector, and my 
experience of the private sector is exactly the same as 
yours, that it has shown, as the private sector has 
moved in to try to deal with the problem, that the cost 
has increased; and that may be the case with this £370 
million. The £370 million is the figures given to me, 
the detailed figures, by all the central government 
departments and their agencies, and we have simply, 
when I say simply, added them up in that respect. Of 
course, we have done much more work with the plans 
than that, we have tried to look at them and gone 
back to them and written to them and checked figures 
with them, but that is their estimate as of October of 
last year. It will be very interesting to see what their 
figure is as of the end of January this year, to see if it 
is the same; whether there has been any change, I do 
not know. I suspect as we move into the system we 
will begin to see the change, if there is going to be a 
change, and I suspect we will begin to see a change at 
the end of the next quarter, ironically, because they 
have just got going on this occasion. But I think the 
message I am trying to get across to departments is, 
“Look, we don’t mind if you’ve got the figures 
wrong, as long as you're tackling the problem”, 
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because it does not matter what the cost, this has got 
to be fixed, otherwise it is a catastrophic effect. So 
that is the message I am trying to get across. There 
are no goodies or baddies, as I said before. 


416. We have heard that the demand for the skills 
to fix this problem will exceed supply, certainly by the 
middle of this year, and, in response to that market 
situation, of course, costs are rising now, almost 
escalating. Have you taken that into account, that, in 
fact, the availability of the skills just will not be there, 
because of the increasing demand, as people begin to 
panic, in response to the problem, knowing that time 
is running out? 

(Dr Clark) Yes, indeed. When we were preparing 
the statement I made to the House on 27 November, 
there were three points which we felt needed further 
work straight away. First, the point about the 
embedded chip; the problem of skills shortages; and 
contingency planning. We felt the initial plans from 
departments and agencies had not dealt with those 
thoroughly enough, so immediately after that 
statement I wrote round to all the secretaries of state 
and other responsible ministers, asking them their 
response to my concern on those three issues. On the 
skills shortages, the general view has been, and we 
have published all the replies, they are on the 
Internet, that we have received since 27 November, 
the general response has been that, as they are 
contracted with private industry for all this work to 
be done, and they claim they have checked with their 
contractors and they have got legal contracts for the 
work to be done, they are more relaxed than perhaps 
private industry might expect. But the other point 
that has been put to me, and I think it is a point of 
interest, because of the vagaries and government 
policies in the seventies, eighties, that most of the 
mainframe computers of central government are 
basically ICL, as opposed to IBM, and therefore we 
think even a figure, even a mainframe, probably in 
the region of about 66 per cent. And, as it is pointed 
out to me, because of the vagaries of the market, that 
is not unique to government but is very heavily 
focused on government, and we actually do not see 
as big a shortage or as big a pressure with ICL 
producers as we deal with IBM computers. So there 
may be something in the responses we have had from 
the departments; it does make a bit of sense in that 
respect. 


Dr Jones 


417. At the beginning of the session, Chancellor, 
you said that you thought that in some areas the 
public sector were ahead of the private sector; which 
are they? 

(Dr Clark) What I really meant was that the public 
sector generally, I think, may well be ahead of some 
private sectors. I think my major concern is, and I say 
this just as a general statement, I think there is 
general concern about smaller companies in Britain, 
and indeed throughout the world, that have got 
problems in trying to be aware of the problem, to 
start with. I think the major companies are becoming 
aware of the problem, and I quoted what Robin 
Guenier said previously. I think the real problem has 
been with the smaller companies here in Britain. 
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418. So you would not say the public sector has got 
anything to teach the big companies? 


(Dr Clark) I think we have something to teach each 
other, by the way, because, in a sense, we are a big 
company on our own, and there are some individual 
private companies who are ahead of us, there are 
some who are not as good as us, and I think we can 
exchange ideas and information; because, at the end 
of the day, it is no use the Government being 
compliant if private industry is not, and vice versa. 


419. I am a bit confused with all this talk about 
random testing, exactly what stage we are at in terms 
of the audit and the assessment of what is required, 
and your responsibility, the £370 million you are 
talking about, that would not include the whole of 
the NHS; what would it include in relation to that? 


(Dr Clark) Dr Jones, perhaps I may tackle your 
problem, with your permission, in two ways; perhaps 
I can answer your second question first and then ask 
Mr Gladwyn if he can come in and deal with the 
technical question about what we mean by random 
testing, if that is helpful. The first point. The figure of 
£370 million I refer to would not include the National 
Health Service at all; all it would include is the 
running and the operation of the Department of 
Health, and its regional offices, of course, but not the 
National Health Service. And, as I say, that would 
refer equally to the Department of the Environment, 
Transport and the Regions, it would include all the 
central work and regional work of that department, 
but would not include local government. 


420. So who in central government has overall 
responsibility, or do you have any responsibility, or 
are you just saying that the Department of Health 
should have the responsibility to ensure that all the 
Health Service is compliant and that the DETR has 
responsibility for local government; do you have any 
responsibility? 


(Dr Clark) Constitutionally and legally, I have no 
responsibility; that is a responsibility of the Secretary 
of State for Health, to make sure of the National 
Health Service. And if you begin to think about it, it 
really would be quite a difficult operation, if someone 
from the centre—it is not impossible, of course— 
started opening means of communication with 
individual health trusts, you can imagine how messy 
and difficult it would be. And that is why we have 
tried to follow the route of raising the awareness of 
the Ministers in those departments, and through the 
ministerial sub-group to try to ensure that Ministers 
try to approach the National Health Service, in this 
case, with the same thoroughness that we have 
approached the Department of Health, so to speak, 
and the same openness as well. 


421. Moving on to the other point though, about 
random testing, that worries me, because I thought 
your audit was supposed to have been completed and 
you would know whether ygu were equipped? 


(Dr Clark) Can I ask Mr Gladwyn to answer your 
question. 
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Chairman 


422. Just before Mr Gladwyn does, if I may, 
Chancellor, I do not wish in any way to reduce the 
responsibility you do have, because from what you 
tell us this afternoon it is quite clear you take your 
responsibility very seriously, but you are, in a way, a 
facilitator, are you not, you are making it easier for 
everyone else that has got direct line responsibility to 
do the job they have to do, you are more than a 
facilitator because you are also checking on them and 
then facilitating again if your check comes up with 
results that you do not particularly like? But that is 
the role you are playing, is it not, within the 
Government? 

(Dr Clark) That is exactly right, because at the end 
of the day I know where the buck stops on 31 
December, it stops with the Government, and I am 
the Minister responsible at the centre of 
Government. 


Mr Jones 


423. There is something very important that you 
have just said, that, frankly, I think I should have 
realised before, and that is that the £370 million does 
not include NHS money and does not include local 
government money? 

(Dr Clark) Or schools, or anything like that. 


424. I am wondering where that money, for local 
government, in particular, is going to come from, 
because I know they are squealing at the moment in 
local government, my own local authority in 
Cheltenham has done all the estimates and it is half 
a million pounds, and they have not got it. Where is 
the Government going to find that money, and do we 
write to you and say, “Can you get your friend, Mr 
Prescott, to find the money?”? 

(Dr Clark) To take your first point, your 
understanding is absolutely accurate, and now I 
think you may also understand why I have been fairly 
sure that my figures of £370 million may not be way 
out, so to speak, because they do fit in with the 
general pattern, I am not saying they are absolutely 
precise, but I think they are not way out, because it 
just does include central government. Clearly, just as 
we said to private industry, private industry will have 
to meet this problem without any help from central 
government, financial help; equally, we are expecting 
public bodies, they know the problems there, they 
should be budgeting for that, and we will be 
expecting them to meet the costs of putting the issue 
right out of their own budgets. 


Dr Jones 


425. So, back to the point about where we are at in 
actually assessing what those costs are? 

(Dr Clark) Yes. 

Dr Jones: And the audit. 

Chairman: You are still on this point, Mr Beard, 
are you? 

Mr Beard: Yes, I am. 

Chairman: We will come to you shortly, Mr 
Gladwyn, we have not forgotten you. Cherry on the 
side of the plate. 
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Mr Beard 


426. All the different agencies, like the Benefits 
Agency, they are excluded from this figure, too? 

(Dr Clark) No, they are in it, the Benefits Agency 
are in it, because they are a Next Steps Agency of 
Government. 


427. And they are in, the Next Steps Agencies are 
in? 

(Dr Clark) Yes. I will supply you with a list, and 
perhaps, Dr Clark, you can circulate it. 


Chairman 


428. Thank you. Mr Gladwyn. 

(Mr Gladwyn) On the question of testing, thank 
you, Dr Clark, what Ministers have sought is a level 
of confidence, in terms of these plans which have 
been published, and a method which has been 
proposed is that a number of departments, and 
particularly smaller departments and agencies, are 
expecting to complete their year 2000 conversion 
within the next few months. So the proposal has 
been, with the agreement of the Ministers responsible 
for those agencies, to pick at random a number of 
systems and to subject those which are certified by 
their operators as being year 2000 compliant to 
rigorous testing, in order to see whether or not that 
is true. So, in the first instance, with the first few, that 
will give us a not particularly statistical set of straws 
in the wind, but at least will give us indicators of how 
good or bad the conversion and testing process has 
been. As we move into the autumn, towards the back 
end of the year, and we start to get some really major 
systems being certified as year 2000 compliant, at 
that point we will be able to get some very meaningful 
early data, at a point where there is still an 
opportunity to pass on lessons and to share 
information on common problems, if such emerge. 


Dr Jones 


429. Can I just clear in my mind what this is. You 
are saying that the departments, the officials, are 
doing the audit, they are testing their systems and 
saying, “Yes, we have a system that is compliant” 
and then you are, at random, going and checking up 
on that; is that the right impression? 

(Mr Gladwyn) That is the proposal. 


430. Just to go back to the financial situation, I 
think you were accepting that it may be that, the £370 
million, it could turn out to be more than that. What 
will happen, will there be additional support for 
departments, if the amounts increase, and what 
about the same for all the other organisations that we 
were referring to, if they turn out to be more 
expensive, and there are people who are saying that 
these costs are an underestimate, will additional 
resources be forthcoming? 

(Dr Clark) Perhaps to come to me again, if I may. 
I think the position is, quite simply, this, that we are 
expecting the departments to meet their obligations, 
and they have been charged to meet this problem, 
they have been aware of the problem, and, quite 
clearly, I cannot anticipate what the next financial 
settlement will be, but certainly in this year’s 
provision there is no extra money available for them. 
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431. Are you not worried that the fact that there 
are not additional allocations may actually limit 
progress in ensuring millennium compliance, if 
people put it off because of budgetary constraints? 

(Dr Clark) I do not think they will. Certainly, as 
regards central government, I do not think that is the 
case. I think what I found encouraging was the way 
in which they have tried to build in the obsolescence 
factor and replacement factor of IT in the run-up, 
and, as IJ say, I think that is quite an encouraging 
thing. And I did get the figure, which has slipped my 
mind, but Mr Gladwyn will actually remind me what 
it is, the percentage of reinvestment is very high 
indeed, is it not, of IT equipment each year? 

(Mr Gladwyn) Yes, Chairman, what is commonly 
taken as a proportion of the IT budget, which is spent 
on what is termed maintenance, varies between 50 
and 80 per cent, that is generally the expenditure 
which organisations require to keep their systems up- 
to-date, to fix known new requirements, and to 
reinvest in them. So there is a continuing state of 
changing, updating and modifying any major IT 
system going on which can be turned to advantage in 
a situation like this. 


Chairman 


432. Thank you very much. Chancellor, I am 
aware of your timetable, we are doing our best to— 
(Dr Clark) No, I am very happy to try to help. 


433. Are you alright for another five minutes? 
(Dr Clark) Yes; no problem. That is fine. 


434. But we did start late, and that is our fault, and 
I know that you have commitments at a quarter to 
five, and we will do our best to keep to that. Can I just 
change the subject to not government and private 
sector, as we have been talking about, but this 
country and other countries, because Mr Nigel Jones 
and I happened to be in Saudi Arabia at the end of 
November, and we talked about this problem in 
Saudi Arabia, where they have got quite a lot of 
computers, and they did not even seem to be aware 
that the problem existed; now it may be they are on 
a different calendar from us, but they did not seem to 
be aware of the problem. I wonder if you have any 
information, either you or Mr Gladwyn, on what is 
happening with our near neighbours, our English- 
speaking neighbours, perhaps, across the Atlantic, 
America, or, more importantly, the French, the 
Germans, the Italians, the Spanish; are they taking it 
as seriously as we are taking it, or are we going to find 
that we get it basically right and, come 1 January the 
year 2000, they have not got it right and we do not 
have telephone links, or financial links, or anything 
else, defence links? 

(Dr Clark) You clearly raise a very serious issue. 
On your defence links, let me make it clear that, 
certainly, I happen to know, and I am choosing my 
words very carefully, that NATO is now addressing 
the problem; so they are aware of it. I think one is 
really on subjective judgement, in this respect, that is 
why I made the point and emphasised it about Robin 
Guenier with Taskforce 2000 making the statement 
that probably people in Britain were more aware of 
this problem than any other country in the world, or 
most countries in the world anyhow. Because I think 
if people are aware they are likely to begin to tackle 
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the problem, I use the word begin to tackle the 
problem. It has been put to me by IT people that 
Britain, and this is purely subjective, it is purely 
opinions that have been expressed to me, that we are 
probably ahead of most European countries, and 
indeed may well be ahead of the United States of 
America. But that is just opinion, but I have heard 
that point repeatedly made to me, in spite of what is 
said in the press. 


435. Thank you very much indeed. I think we have 
come to the end now. I would like to thank both you, 
Chancellor, and Mr Gladwyn, for his support as well. 
But I do have just one final question for you, 
Chancellor. We have all heard about your famous 
red box, that is electronic and computerised, and so 
on; my question is, is it 2000 compliant, or is there a 
possibility that at one minute past midnight, on 1 
January the year 2000, despite your fingerprint and 
your card, it will not open and will stay closed for the 
rest of your term as a Minister? 

(Dr Clark) That would be very happy for me, 
would it not, if it did not work out; at least I would 
have a quiet Christmas recess. It obviously 1s 
millennium compliant, and I would just like to say to 
this Committee, knowing your interest, the real 
advantage of the red box is going to be when we get 
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the Government secure Intranet up and running, 
because it will mean that if I am up in my 
constituency and IJ have got a dedicated line I will 
simply be able to plug in the red box and up in the 
lap-top I will have access to all Government 
information and messages, and this sort of thing. 
And I think that is going to make Government very 
much better, and that is going to be the great plus of 
the electronic red box. I think a number of us may 
find it a bit frustrating not having the paper things; 
but it is going to come, I am quite certain about that. 


436. Thank you very much indeed, Chancellor. 
Thank you for the good-natured way you have 
answered all our questions, the tremendous amount 
of help you have given us, and we wish you well in all 
that you do. We hope that you might find our report 
of some interest, when we produce it within a few 
weeks, and, once again, thank you, thank you, Mr 
Gladwyn, for being with us. 

(Dr Clark) And if I could just say that if you feel 
we can give you any extra help, any written 
documents, we will be delighted to try to do that. 

Chairman: Thank you very much indeed. Thank 
you. 
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Memorandum submitted by the Health and Safety Executive 


INTRODUCTION 


1. The Health and Safety Commission (HSC) has overall responsibility for policy and the administration 
of the Health and Safety at Work etc. Act 1974 (HSWA). The HSC, together with its operational arm the 
Health and Safety Executive (HSE), are responsible for health and safety standards and regulation in higher- 
risk premises including factories, power stations, chemical installations and oil refineries. Local authorities 
are responsible for enforcing the Health and Safety at Work etc. Act 1974 (HSWA) in premises allocated to 
them under the Health and Safety (Enforcing) Authority Regulations 1989, which generally come within the 
lower end of the risk spectrum. 


SCOPE OF THIS NOTE 


2. The Science and Technology Committee has raised the specific problem of the ability of computers and 
other software-driven systems to cope with the transition from 1999 to the year 2000. There is also a more 
general problem of “date discontinuity”, which is described briefly in Annex A, and which the Committee 
may wish to note. This brief deals only with the more specific problems associated with the run-up to the 
millennium. 


THE “YEAR 2000” PROBLEM AND WHAT CAUSES IT 


3. In most engineering, production and manufacturing environments, a variety of computerised systems 
are used to plan, measure, store information control processes and keep them safe. Systems may also be linked 
together by communications networks, and information shared and used for different purposes. When such 
information is both time or date-dependent and important for the safe operation of a process or machine, 
safety may become an issue at the year 2000. Moreover, because of linkages between systems, a system which 
is itself resilient to the “Year 2000 problem” may still be affected by the failure of a subsidiary system to which 
it is linked. 


4. The problem is created through using a two-digit descriptor for the year in those systems which rely on 
a calendar. Thus “99” is the two-digit descriptor for 1999, and when the calendar advances to the year 2000, 
the 99 will roll over to “00”. At this stage the software may be able to cope with the change, interpreting the 
“00” correctly as the year 2000. Alternatively it may consider that the calendar has regressed to 1 January 
1900, in which case the software may think it is running 100 years late. 


5. The changeover from 1999 to 2000 is the most readily-recognised aspect of the “Year 2000 problem”. 
However, it is not limited to 31 December 1999. (There is also the more general problem associated with date 
discontinuities described in Annex A). 9 September 1999 is a potentially critical date because of its 
representation as “9999”, which some computer systems may recognise as an “end code” (at which point the 
system may shut down). There are also potential problems associated with the fact that 2000 is a leap year. 
Centennial years are leap years only if they are divisible by 400. Thus 1900 was not a leap year but 1600 was, 
and 2000 will be. Some systems may be incorrectly programmed and risk failure at 29 February 2000 or 
31 December 2000 (the 366th day). 


HEALTH AND SAFETY LAW AND RESPONSIBILITIES 


6. Employers have general duties under sections 2 and 3 of HSWA to ensure, so far as is reasonably 
practicable, the health, safety and welfare at work of their employees, and the health and safety of those who 
could be affected by their work activities. They also have more specific duties, under regulations, to provide 
and maintain plant and systems of work that are, so far as is reasonably practicable, safe and without risks 
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to health. Employers also have legal duties under the Management of Health and Safety at Work Regulations 
1992 (as amended), to carry out a risk assessment on their work activities, including plant, machinery and 
work equipment. On the basis of this assessment duty holders must take adequate steps to control the risks. 


7. Where work equipment is concerned employers have more specific duties under the Provision and Use 
of Work Equipment Regulations 1992 to ensure that work equipment is so constructed or adapted to be 
suitable for the purpose for which it is used or provided (Regulation 5) and that all control systems of work 
equipment are safe (Regulation 18). 


8. It follows that the Government as an employer will also have duties to ensure that its own safety-critical 
systems are managed to ensure health and safety. 


9. Ifsuppliers provide products covered by regulations implementing Article 100A Directives of the Treaty 
of Rome (for instance, the Machinery Directive), these products must be safe. Under the Supply of Machinery 
(Safety) Regulations 1992, as amended, the responsible person has duties to make sure a fault in the control 
circuit logic does not lead to dangerous situations. Thus, for machinery supplied after 1 January 1993, 
suppliers should have addressed the year 2000 problem in the software. 


HEALTH AND SAFETY ENFORCEMENT RESPONSIBILITIES 


10. HSE inspectors enforce health and safety in factories, building sites, mines, farms, fairgrounds, 
quarries, railways, chemical plant, offshore and nuclear installations. Under the Health and Safety (Enforcing 
Authority) Regulations 1989 Local Authority enforcement officers cover retailing, some warehouses, most 
offices, hotels and catering establishments, sports, leisure, consumer services, places of worship, etc. 


11. Employers for work activities which are the subject of the Offshore Installations (Safety Case) 
Regulations 1992, or the Railways (Safety Case) Regulations 1994, are required to produce a safety case. 
These safety cases are handled by the Offshore Safety and the Railway Inspectorate respectively. Dutyholders 
under the Control of Industrial Major Accident Hazards Regulations 1984 produce safety reports as part of 
the information they are required to produce under these regulations. Employers in the nuclear industry are 
subject to a licensing scheme under the Nuclear Installations Act 1965 (as amended); licence applications have 
to be approved by the Nuclear Installations Inspectorate. 


ENFORCEMENT APPROACH 


12. HSE 1s fully seized of the safety-critical implications of computer software failure and in the past has 
produced some general guidance on the matter; this is listed at Annex B. 


14. Inspectors preferred initial enforcement approach is through advice and guidance. This advice will be 
in the context of the requirement of the Management of Health and Safety at Work Regulations for 
dutyholders to review any existing risk assessment in light of the “Year 2000 problem”. This will include 
government departments. If dutyholders fail to repond to this advice and guidance, and there is currently 
no evidence of this, inspectors will not hesitate to take appropriate enforcement action, including the use of 
improvement and prohibition notices and if, necessary, prosecution. 


HSE RESEARCH 


14. HSE has commissioned two new pieces of research to deal with the particular problems that the century 
date change might cause for safety critical systems. One is from Real Time Engineering Ltd, Glasgow and 
the other from the HSE’s Health and Safety Laboratory. The research from Real Time will be published 
shortly and will provide information about the scope and nature of the problems and potential failure modes. 
It will also provide a suggested methodology for identifying the extent of the problem and a strategy for its 
solution. The research from the Health and Safety Laboratory (“Investigation of the Year 2000 problem with 
respect to safety-related control systems”) centres on the potential effects of the date change using a computer 
system whose clock has been artificially advanced to simulate the change. 


15. Both pieces of research demonstrate that there is no universal answer to the problem and that the same 
software running on different computer system could produce different results. The implications are that duty 
holders will need to ensure, in the case of safety-critical systems, that each software application is identified 
and the effect of the date change assessed. Once that assessment has been done any necessary changes will 
need to be made. 


16. Based on this resear¢h, HSE is producing further guidance for dutyholders on what they should and 
should not do, and where to go for sources of advice. Dutyholders may need to go to their suppliers for help 
in tackling the problem. 
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HIGH-HAZARD WORKPLACES 


17. HSE is paying particular attention to high-hazard installations as follows: 


— Site inspectors within the Nuclear Installations Inspectorate have written to their respective nuclear 
sites asking them to demonstrate an adequate approach to the potential risk. The Inspectorate will 
be assessing the licensees’ proposals to ensure that safety levels are maintained. 


— The Chemical and Hazardous Installations Division has approached the chemicals manufacturing 
industry through the tripartite Chemicals Industries Forum. Members were also given an 
information note to distribute within their organisations with the aim of further increasing 
awareness and getting companies to take the first steps to establish whether or not they have a 
problem and need to take remedial action. 


— HM Railway Inspectorate (HMRI) are in consultation with the principal players in the rail industry 
(Railtrack, London Underground Ltd, Eurotunnel etc) on what they are doing about the problem. 
The main industry members are undertaking surveys to determine the scale and possible effects of 
the problem so far as embedded systems are concerned. HMRI are monitoring industry activity. 


— The Offshore Safety Division is giving a presentation to the HSC’s Oil Industry Advisory 
Committee and will monitor how the offshore industry is coping with the problem. 


— HM Inspectorate of Mines is contacting employers’ and an HSE working group addressing this 
topic will shortly produce a checklist for circulation to dutyholders. 


HSE’s current assessment is that employers with high-hazard installations are taking their responsibilities 
seriously. 


OTHER PREMISES 


18. In the remainder of workplaces, HSE’s Field Operations Directorate and local authority inspectors 
can use the publication of HSE’s research and guidance (para 16) to help raise dutyholders’ awareness. Where 
inspectors visit premises as a matter of routine they will ask dutyholders if they have safety-critical systems, 
and refer them to the guidance. Where there are safety-critical systems, inspectors will ask if risk assessments 
have been revised to take the year 2000 problem into account and, where appropriate, check that action is 
being taken to deal with any potential problems. Where inspectors find safety-critical problems which present 
a significant risk they will require employers to get advice and gain expertise from suppliers (or consultants, 
if necessary) to ensure the the time-critical aspects are dealt with. 


CO-ORDINATING GOVERNMENT ENFORCEMENT WORK 


19. HSE is trying to promote a co-ordinated approach to employers to ensure that they have consistent 
advice and guidance and meet their legal duties. Angela Eagle, Parliamentary Under-Secretary of State for 
the Department of the Environment, Transport and the Regions, has specific responsibility for health and 
safety issues. She wrote to colleagues on 21 November about the establishment of an official enforcers’ 
committee which HSE will co-ordinate. Ms Eagle’s letter also alerted Government Ministers to the safety 
critical implications of the year 2000 problem. 


HSE Next STEPS 


20. HSE’s next steps will be to: 
— Publish the RTEL and HSL research reports (see paragraphs 14-15 above). 
— Produce and publish guidance (see paragraph 16 above). 
— Continue to monitor and evaluate employers’ responses (including Government as an employer). 
— Take proportionate enforcement action, where appropriate, to ensure compliance with the law. 


— Keep the situation under close review to ensure that experience is shared where appropriate, and 
additional research commissioned if necessary. 
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Annex A 


DATE DISCONTINUITY 


1. Date discontinuity occurs when the time (as expressed by a system or its software), does not successfully 
move forward in line with true time. For instance, some software systems are equipped with “clocks” which 
calculate time from a fixed point (eg by counting the number of clock ticks since 1980, or some other arbitrary 
date of significance to the manufacturer). When the register which accumulates these clock ticks is full, it will 
overflow (like a car odometer) and show zero. This will be interpreted by the software as the fixed date of 
origin ie 1980. 


2. The failure mode may cause the software to “crash”. More generally, an incorrect year change or 
recognition will produce unpredictable results. Date-dependent systems may then produce incorrect results 
or fail completely if these incorrect year numbers are used in arithmetical calculations. Alternatively the 
system may continue without any immediate apparent effect but time-critical aspects of the software may be 
affected eg valves which are timed to operate at particular intervals may not open or shut. 


Annex B 


GUIDANCE DEALING WITH THE FAILURE OF CONTROL SYSTEMS 


1.1 HSE issued guidance of the design of safety-related computer control systems in 1987 titled 
“Programmable Electronic Systems” (PES) in safety-related applications. 


This guidance was in two parts and was re-issued with new ISBN as follows: 
Part 1: An introductory guide, ISBN 0 7176 12783, February 1997, price £5.50 
Part 2: General technical guidelines, ISBN 0 7176 05450, November 1995, price £12.50 


1.2 HSE continues to contribute to the development of European and International standards on the 
design of control systems as follow. 


BS EN 954: Safety of machinery—safety-related parts of control systems: 

Part 1: General principles for design, issued in 1997 

Part 2: Validation (in preparation) 

IEC 61508: Functional Safety of electrical/electronic/programmable electronic systems 
Part 1: General requirements 

Part 1: Requirements for electrical/electronic/programmable electronic systems. 
Part 3: Software 

Part 4: Definitions and abbreviations 

Part 5: Examples of methods for the determination of safety integrity levels 
Part 6: Guidelines on the application of parts 2 and 3 

Part 7: Overview of techniques and measures. 


Note | Parts 1, 3, 4 and 5 will be issued as Final Draft International Standards which national 
committees will be asked to accept by formal vote. Acceptance will lead to publication in late 1998. 


Note 2 Parts 2, 6, and 7 will be issued as Committee Drafts for vote and comment. Acceptance will 
lead to these parts moving to Final Draft International standard stage with possible publication 
in 1999. 


1.3 Although standards take a long time to emerge, the basic principles used to draft their requirements 
come from within industry and are therefore well known. Industry is kept well informed of progress in the 
standards working groups through formal consultation and informal contact between interested parties at 
National and International levels. 
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Examination of Witnesses 


Mr Davi Eves, CB, Deputy Director-General, Mr CLIVE Norris, Director, Safety Policy Directorate and 
MR Ron BELL, Head of the Electrical and Control Systems Unit, Directorate of Science and Technology, 


Health and Safety Executive, were examined. 


Chairman 


437. Order, order. Mr Eves, welcome to the 
Science and Technology Select Committee. Thank 
you for coming along and bringing two of your 
colleagues with you. Before we start our questioning, 
would you care just to say a few words about yourself 
and to introduce your two colleagues? 

(Mr Eves) Thank you, Chairman. Good 
afternoon. On my right is Mr Clive Norris who is 
Director of Safety Policy for the Health and Safety 
Executive and Mr Ron Bell is Head of our Electrical 
and Control Systems Unit in our Directorate of 
Science and Technology. I am David Eves; I am the 
Deputy Director-General of the Health and Safety 
Executive. My responsibilities embrace all of the 
operational side of our business which includes all 
the work of the inspectorates, science and technology 
capability and some other activities, so I think that is 
enough about me. Would you like me just to say a 
little bit about where we are coming from, Mr 
Chairman? 


438. Provided it is very brief, Mr Eves, because we 
do prefer to get information from our own questions, 
but a brief opening statement would be welcome? 

(Mr Eves) I do understand, Chairman, and thank 
you very much for the opportunity and I know you 
are extremely well informed already, but I thought if 
I just said what our strategy was as the health and 
safety regulator for tackling the Year 2000 problem 
it might be a helpful starting point. Essentially it has 
four elements. Carrying out or commissioning 
research which we have done and are continuing to 
do, so that we get better understanding of the nature 
and scale of this problem so far as it affects health and 
safety. You are probably aware of the report that we 
have recently commissioned by Real Time 
Engineering Limited and we can say more about 
that, but we also have some in-house research in 
progress and we are also carrying out a survey of 
Year 2000 Compliance on major hazard sites in the 
chemical sector which are not currently covered by a 
safety case regulatory regime unlike the nuclear and 
the off-shore and the railway sectors. The second 
element of our strategy is raising awareness. This is 
by means of published reports. You have probably 
seen Safety and the Year 2000. We published that in 
January. We are publishing guidance; in April we will 
be publishing some free guidance for SMEs. We are 
also raising awareness through contacts with 
employers and trade associations, professional 
bodies; for example, Mr Bell is a Member of the 
Institution of Electrical Engineers. We have a lot of 
contacts with all the professional bodies, with the 
standards making bodies and are speaking and 
participating in technical seminars. The third 
element of our strategy is to co-operate with other 
departments and agencies so in particular this means 
DTI and Action 2000, with whom we have 
established very good links and, I think, rapport. 
Finally as we are the enforcing authority for health 
and safety, we have formal enforcement as the fourth 


element of our strategy. I think I would like to make 
it clear at this stage that we are not regarding that as 
the answer to the problem. All four elements of the 
strategy we think are vital. 


439. Most helpful, Mr Eves. I think it took two and 
a half minutes. If everyone was as succinct as that we 
would welcome opening statements more than we do. 
The trouble is, some people take 20 minutes and that 
is too long. You have told us where you are coming 
from. May I just tell you in reply where we are going 
to. We really have two things we are finding; one is 
that we are anxious about the safety to the general 
public that might be brought about by computer 
systems or IT systems not being 2000 compliant and 
second, we are trying to find out what is being done, 
what is the solution to the problem. We hear a lot 
from our witnesses telling us about the problem; we 
hear not so much about solutions. Today, with you 
as our witnesses, we would like to talk about 
solutions and first of all we would like to talk about 
dangers and then we would like to talk about 
solutions. So may I ask the first question? We hear a 
lot in the press about possible dangers to the general 
public. Could you give us a brief outline about how 
severe and how real these dangers may be; not will be, 
but may be, because there are some people in the 
press saying that it goes between total catastrophe 
and over-exaggeration and nothing is going to 
happen at all, it is over-exaggerated? Where is the 
truth, Mr Eves? 

(Mr Eves) A simple question, but a difficult 
question, is it not? We are responsible for high hazard 
industries such as the nuclear and major chemical 
installations, off-shore installations. Some of these, 
of course, pose off-site risks. Now the work we have 
done with these industries through individual 
companies and through their associations convinces 
us that there is not actually a major problem there. 
An enormous amount of work is going on. Nuclear 
reactors, their protective control systems are 
generally hard-wired. We are not looking at safety 
critical software problems in most of those major 
hazard areas. Nevertheless we are pressing these 
companies to demonstrate to us, either through their 
safety cases or through special inquiries, that they 
have actually got abreast of the Year 2000 problem. 
But I make that point simply because Health and 
Safety Law requires employers, operators of plant 
like that, to take account of risks off-site. The safety 
of the public is actually embraced by Health and 
Safety Law; it is not just about employees. We are 
also responsible, of course, for the enforcement of 
safety on the railways where probably public safety 
is the biggest issue and we are engaged in discussions 
with Railtrack as the main infrastructure controller. 
They have to present a safety case to us as the 
regulator, but they are also in a system which also 
requires them to accept or reject safety cases from 
train operators wanting to come on to their system. 
We are also convinced that the problem is being 
properly addressed in that sector. Where we are less 
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clear—and I have to be frank about it—is about the 
extent of the problem, and you have asked about risk 
to the safety of the public, arising in the SME sector 
which is vast; we estimate something like 3.7 million 
businesses in the United Kingdom. The majority of 
those will be small firms employing fewer than 50 
people and inevitably these days many of those will 
have programmable electronic systems, 
computerised systems, software of various kinds, 
some of which could have safety implications and 
that is where we are doing research and hoping to 
raise awareness. So I cannot give you a simple answer 
to your question; we are not in the scaremongering 
end of the spectrum but neither are we at the “there 
is no problem” end of the spectrum. We think there 
is a serious safety problem to be addressed and we are 
hoping to engage everybody’s attention to that 
problem. 


440. I do not think there is anything really in your 
answer, Mr Eves, if I may say so that would be very 
attractive to a press journalist one way or the other. 
Are trains going to crash because points are not 
going to switch? Are there going to be accidents 
because nuclear processors will suddenly die at 
midnight on 31 December next year? Is that the sort 
of thing that is scaremongering and is that the sort of 
thing we can rule out? 

(Mr Eves) I think we can rule that out. We are 
making great efforts ourselves as the regulators to 
make sure that in those high hazard sectors that sort 
of thing just cannot happen. 


441. Would it be fair to say that what we are going 
to see on 31 December 1999 is more likely to be a 
series of inconveniences than a series of major 
hazards? 

(Mr Eves) I think that is probably so. Some of 
those inconveniences could however have safety 
implications. 


442.1 am not belittling it by making that comment, 
but I am trying to take some of the sting out of the 
scaremongering? 

(Mr Eves) Yes. 


443. Could I just finally ask before my colleagues 
ask questions I am sure, in your memorandum to us 
you talk about dates we already know about, 9 
September 1999—9999—which we are told has been 
a dumping date for various programmers in the past 
and there might be some complications there which 
will be three mdnths before the key date. 31 
December 1999 we know about. 29 February because 
that is a leap year when it should not be in a 
millennium year; it could be a complication and even 
31 December, 2000 you mentioned could be. Are 
there any other dates that might come along as being, 
quote “interesting” ones? 

(Mr Eves) There are one or two other interesting 
dates and I think if I may I will ask Mr Bell to answer 
your question? 


444. Mr Bell? 

(Mr Bell) Thank you, Chairman. I think that as we 
progress with our research,and as our programme 
develops, we are actually gétting further information 
on the likely dates. At the present time this is the list 
we are sticking by. 
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445. Mr Bell, could you just tell me why 31 
December 2000 could be an interesting date? 

(Mr Eves) It is the 366th day— 

(Mr Bell) Oh yes, it is the 366th day year. 


446. Yes, in the leap year date, that is right? But 
there are other ones coming up, you think, from your 
research? 

(Mr Bell) We have no evidence of that. What I am 
saying is that these dates that have arisen, we started 
off with just the one date and during the past several 
months other dates have come up and people, 
particularly people who are doing millennium 
work—consultants doing millennium work that we 
have contact with and the people who in fact did this 
work for us—as they do the work they then find dates 
that have been used in this particular way and flag 
them up to us. 

Chairman: Thank you very much indeed. Mr 
Jones? 


Mr Jones 


447. Chairman, I wonder if I might just ask a 
question? You mentioned the nuclear industry. We 
had some evidence that seemed to indicate that each 
nuclear power station would have to be taken out in 
order to upgrade various parts of the system in order 
to do that and it takes rather a long time to do that, 
maybe a month to take it out and a month to wind 
it back up again after everything being tested. I also 
understand that the demands of the national grid are 
that you can only take one nuclear power station out 
at any one time. Do we have enough two-month slots 
to take the nuclear power stations out? 

(Mr Eves) If I could start one step back, if I may, 
nuclear power stations as I said earlier, the reactor 
circuits themselves are not in any way time or date 
dependent in terms of their protective controls. We 
are, however, pressing for justification of all of the 
systems at nuclear power stations. Some of these will 
not apparently be linked to any other safety critical 
activities, but just as we, as with any other industrial 
sector, want to alert people to the fact that there may 
be embedded systems which could cause problems, 
probably bits of the plant shutting down which in 
itself will not be unsafe but possibly leading to other 
consequences, we are confident in our discussions 
with the nuclear industry that there is not a problem 
affecting nuclear safety at these plants. Now you ask 
about shutdowns. There is a system of shutdowns at 
nuclear power plants. The reactors themselves have 
to be shut down from time to time; outages, and huge 
amounts of work are done during that period and I 
think as the normal programme of outages continues 
companies will be taking advantage of those 
shutdowns to do other things, such as checking their 
other systems for Year 2000 compliance. So I do not 
think there is going to be a threat to the national grid. 


448. In your memorandum you mentioned an 
official enforcers’ committee. Has this committee 
been set up and has it met yet and what is its precise 
role and which agencies are represented on it? 

(Mr Eves) When we put that submission to you 
that was certainly the state of play and indeed we set 
the ball rolling and wrote to departments and were 
really moving towards a meeting where we would all 
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get together. This however has been overtaken, I 
think, by the establishment of MISC 4 Committee. 
That of course is supported by DTI and we are 
involved in giving some support to that Committee 
and I am sure that amongst other things it is going to 
do the co-ordination of enforcement authorities’ 
approach to this problem that we had originally 
volunteered to do. 


449. How will this new committee actually help the 
enforcement agencies to make sure that their 
constituents are taking appropriate action? 

(Mr Eves) I imagine, because I have not yet been 
involved in its working, that they will want to see that 
enforcement authorities, such as ours, such as 
perhaps the Environment Agency, Civil Aviation 
Authority and so on, are sharing information about 
this problem and, where necessary, are adopting a 
common or consistent approach when in some cases 
companies at the receiving end of regulation are 
subject to the attention of more than one regulator 
and we want to be consistent in this approach. I think 
by having put our own document on the table with a 
methodology we would hope that this would be a 
kind of benchmark for consistency and for co- 
ordination of this kind of approach, but we are 
always open to suggestion and we wait to see how 
that unfolds. 


Mr Atkinson 


450. We received some representations from 
Savills, the international property consultants, that 
many commercial buildings share the same threat 
from the time bomb as computers do which they feel 
has not been adequately addressed, such as the 
numerous service installations that regulate the 
operations of buildings which rely on the controls 
which have embedded chips and micro-processors 
and they paint a worst case scenario that we could see 
a loss in function of security installations, fire alarms, 
air conditioning, heating systems, escalators and 
back-up systems such as generators. Is it the 
responsibility of your Executive to address these 
particular problems and, if so, how are you doing it? 

(Mr Eves) It is not actually our responsibility 
except that there will be some of those systems 
perhaps controlling maintenance intervals for lifts 
where the interruption, apart from _ being 
inconvenient, could actually be frightening to people 
and could possibly be unsafe in certain 
circumstances. So we do have an interest in that, but 
we do not have a majority interest. Business 
interruption, if I put it that way, is not our 
responsibility for dealing with although we do 
recognise that it could be a difficulty in the kind of 
premises you are talking about. In fact, we see the 
threat of business interruption, the commercial 
pressure on people arising from that, as being quite a 
favourable element in driving for _ safety 
improvements or at least getting attention paid to 
safety implications. So we hope for some spin off 
from that, but it is not our responsibility is the 
short answer. 

Mr Atkinson: Thank you. 


Dr Jones 


451. I appreciate that for high hazard sites you 
have a direct relationship with those that are running 
them, but in relation to SMEs you said you were 
producing some information. Are you producing 
your own information that you are disseminating 
yourself, or are you putting proposals to Action 2000 
so that it can all be co-ordinated? 

(Mr Eves) We are doing both. We are producing 
our own free leaflet which will, I hope, put into small 
business friendly language some advice about how to 
tackle the problem and at least start off by identifying 
the hazard. I mean, do they actually have a problem 
is the starting point and then giving them some 
guidance on how to go forward with that. We feel we 
need to do that. The Health and Safety Commission, 
for whom the Health and Safety Executive works, is 
very keen to assist small firms in improving their 
health and safety standards and that is essentially an 
initiative flowing from the Commission’s policy 
towards helping small firms. But we will, of course, 
also be assisting with Action 2000’s campaign 
because I think there are a variety of means of getting 
the message through and one of our techniques is 
really to work through intermediaries—that is why 
we talk to trade associations—and Action 2000 is a 
major intermediary as far as the HSE is concerned in 
getting our message through. So there could be some 
duplication but I do not think there is any harm 
going to be done by that. 


452. Has Action 2000 produced a check list and 
have you input into it? 

(Mr Eves) I think not as yet. 

(Mr Bell) Action 2000 have produced a package 
with a number of sheets which is growing and as the 
programme develops they are producing more. What 
we have now done is actually tied in with their 
programme so that when our document comes out it 
will actually be part of a two-part presentation pack. 
There will be the DTI material together with the HSE 
material and we have tailored our material to fit in 
with the DTI material. So basically it gives us a much 
higher gearing in terms of getting the information out 
to SMEs. 


Dr Gibson 


453. I would like to follow up on your awareness 
raising plans. How do you monitor that they are 
taking your advice? Do you actually go in on site and 
if you have not done that yet, are you worried in any 
industry and might there be a cut-off point where you 
do have to have a site visit? You must have talked 
about that, I am sure. At what point would you go 
into a company or a particular industry and do 
something and have you done it yet? 

(Mr Eves) Between now and the year 2000 we will 
carry out roughly 200,000 site inspections for health 
and safety purposes generally. We are obviously 
raising awareness of our own inspectorates to the 
problem. We have talked about high hazard 
industries, I have mentioned the size of the problem 
for smaller firms and clearly if there are 3.7 million 
small firms with 200,000 inspections, even though 
that sounds impressive it is hardly going to scratch 
the surface of the problem. Which is why we are 
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trying to use other means now in terms of raising 
awareness. For example, we held a press conference 
when we launched our guidance; that was well 
reported in the national press and will run for some 
months I suspect in the technical journals which 
smaller firms tend to read for their own business 
purposes, so we will be doing that. When inspectors 
come across a problem, it could be specific, you 
know, they just happen to find it by conversation 
with an employer in a small firm, they will obviously 
deal with that problem and give advice and point 
people in the right direction and at the end of the day 
could take enforcement action, but the point I am 
trying to make is that we do not see that as the 
answer; it is part of the answer, but it is not the 
whole answer. 


454. But you are not ruling it out as a strong 
possibility in the next year perhaps? 

(Mr Eves) We have got two years, have we not? I 
think this coming year we are very much in the 
awareness raising phase, getting the information out 
to people. We will learn more about the size of the 
problem and we will learn more about the specifics of 
the problem. There may be some sectors—we are 
looking closely at the chemical sector, for example, 
where there are a lot of small firms—where we need 
to do more. 


455. So you do not lie awake thinking you might 
be too late in one company? 

(Mr Eves) No, I do not lie awake thinking we 
might be too late in one company. I am sure that 
there will be many companies that we will not have 
visited by the year 2000 who could have a Year 2000 
problem. I hope that our contribution in getting 
them tuned into the problem and getting them in line 
with good practice and perhaps taking advice from a 
bigger firm or from a respectable consultant will 
actually help them solve their problem. They are the 
duty holder, we are not. We are the regulator. We can 
do so much, but at the end of the day they have to try 
and get it right for their own businesses. 


Dr Williams 


456. You say that there are 200,000 site inspections 
a year, is that right? 
(Mr Eves) No, in the next two years. 


457. In the next two years. This Year 2000 
Compliance is just part of that site visit at this stage. 
What percentage of the time of inspectors on sites 
would be dedicated to this problem? 

(Mr Eves) 1 think that will depend, will it not, on 
the kind of establishment that the inspector is 
visiting? It is on the agenda now. It is one of anumber 
of issues that inspectors will raise with firms and if in 
the dialogue, by probing, we establish that this 
particular firm has a problem the inspector may 
decide to spend all his time on that occasion in 
dealing with it. There are legal requirements, quite 
elaborate legal requirements, for risk assessment 
already in place and the inspector can say: “I would 
like to see your risk assessments and your safety 
management plans” and if it is clear that the Year 
2000 Compliance has not been raised within the firm, 
he can raise it with them. 
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458. You do expect them to make some dedicated 
site visits on Year 2000 Compliance? 


(Mr Eves) I am sure that some of the visits that 
some of our inspectors pay will turn into dedicated 
Year 2000 Compliance visits because we also learn 
from those and we will bring back from that 
inspector’s experience information which we can 
disseminate to the rest of our field force. 


459. If there is a genuine problem here of some of 
these medium sized companies not being compliant, 
do you have the resources to really carry out a 
detailed inspection in six months’ time, in 12 months’ 
time or over the next 18 months? Do you have the 
resources? 


(Mr Eves) We do not have any additional 
resources specifically for this problem. We have 
about, at the moment, 1,440 inspectors roughly. We 
shall be recruiting more inspectors over the next 
couple of years because the Government has 
increased our budget this year for that purpose, but 
we do not have a dedicated force of inspectors for this 
problem. What we have are some specialists, like Mr 
Bell, who interact with a number of other 
organisations and other technical specialists outside 
and if necessary we could bring to bear our S & T 
capability on a single firm’s problems, but I am not 
sure that we would see that as an efficient use of our 
resources. 


460. You said that there were no additional 
resources to tackle this problem next year, yet when 
we ask numbers from Government or from the banks 
and so on, we are talking about hundreds of millions; 
something like £370 million I think the Government 
quoted for its own departments. The banks, later this 
afternoon, have a global figure of about a billion 
pounds they are spending. Yet in your own case no 
additional resources and in terms of personnel just 
time taken from the 1,440 inspectors. Could I just set 
that against as well Shell when they were here quoted 
a number of 60 full-time equivalent members of staff 
already involved in testing their equipment to make 
sure that it was compliant. Are you not being 
incredibly relaxed about it? 


(Mr Eves) I hope we are not being relaxed about it 
in the Health and Safety Executive. I was answering 
your question in relation to our field force and the 
kind of work that they do with companies. So far as 
my own organisation is concerned, which has a lot of 
IT in it—everybody has a PC for example—we are 
actually carrying out our own Year 2000 Compliance 
programme and putting a lot of effort into that. I 
believe we are spending about £970,000 over the next 
two years to make sure that all of our systems, most 
of which are not safety critical of course, are actually 
Year 2000 compliant. Now I cannot compare our 
£970,000 with the figures of a multi-national 
company that you have just mentioned, but we 
believe it is that level of resource that we have to put 
in to get our systems right. We are trying to persuade 
and, if you like, be a catalyst amongst employers that 
they too should be spending some of their resources 
on averting problems which might have safety 
repercussions. 
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Dr Jones 


461. What is your total budget? 
(Mr Eves) Our total budget right now is a little less 
than £200 million. 


462. And you are having to spend nearly £1 million 
on your own compliance? 

(Mr Eves) This is from our own computerised 
systems budget which we are prioritising to sort out 
our problems right now. It is not the whole of our 
computer budget. 


463. Do you think you do have enough resources 
to tackle this problem and enough trained personnel? 

(Mr Eves) Yes, I think we have the expertise in our 
various inspectorates to be able to ask the 
challenging questions. That is our job. It is not our 
job to go in and provide expert consultancy advice to 
companies. I believe we could do that, but that is not 
our job. So I think with our current level of 
resources—and it would be impractical of us to 
imagine we could double the size in the next two 
years—I think we can do a good job in stimulating 
industry. 


464. I take it that although you are not able to visit 
every firm you will be visiting every high risk site and 
are you setting some kind of timetable with them for 
compliance? I would gather that you have not issued 
any prohibition notices or any other kind of 
enforcement action, but what might have to happen 
to trigger such action? 

(Mr Eves) High risk sites are visited in our 
programme of work annually. That is our target; we 
achieve that target. So every high hazard, high risk 
site or establishment will be inspected, probably 
twice before the year 2000 and in some cases 
probably a number of times more than that because 
other issues will arise. I think the answers we are 
getting back from major companies in those high 
hazard sectors indicate to us that they will have 
completed their programme by the end of this year, 
1998, which is when incidentally we intend in HSE to 
complete our own programme. It seems to me that 
this is a sensible target. The majority of people I think 
can achieve that, particularly if they started a little 
while ago as a number of the bigger organisations 
did. So I think in a year’s time we will be appraising 
the situation and deciding whether we move into the 
more formal enforcement stage that I mentioned 
earlier. That is when you might see some 
improvement notices or prohibition notices. 


465. But at this stage that is still a possibility, that 
although people are hoping that they are going to 
have completed all their testing by the end of the year 
that if they have not, you might envisage issuing 
some compliance notices? 

(Mr Eves) It is certainly one of the shots in our 
locker and we do, as I am sure you know, issue them 
and prohibition notices. 


Chairman 


466. You have the authority to do that? 
(Mr Eves) We have the authority to do that. 


467. You would not need any new authority? 
(Mr Eves) No. It would be based on the opinion of 
an inspector. That is what the law requires. 


Chairman: That is very helpful. Thank you very 
much. Mr Beard? 


Mr Beard 


468. What proportion of the safety critical systems 
in, for instance, a nuclear installation are dependent 
on some date, time chip function or are themselves 
linked to something that is dependent on a date, time 
function? 

(Mr Eves) None of the safety critical systems 
related to the nuclear reactor itself are time, date 
dependent. We are satisfied on that point. Neither is 
there any linkage with other systems where there is 
such a dependency. We want to be sure, however, 
whether it is a nuclear plant or a chemical plant or 
anything else, something else might not happen 
which although not directly connected with the 
control of the reactor could actually affect people on 
site and cause an accident—if you like, a 
conventional safety accident—which in turn might 
impair the command structure’s ability to cope with 
the running of the plant as a whole. Now that is a 
pretty remote risk, but it is the kind of inquiry we are 
currently making which we are expecting the 
industry to demonstrate to us that they have 
addressed. 


Chairman 


469. May I just interrupt there? Mr Eves, we hear 
cases where when there is a subtraction of one date 
from another—for example, to try to find places in 
primary schools for five year olds and you get 98 year 
olds being told that there will be a place for them in 
the year 2003 because it is one date subtracted from 
another, or when it comes to paying pensions which 
is one date subtracted from another—we can 
understand how the computer compliance can throw 
up anomalies which in the cases of which I have just 
told you causes us all to smile, but if it was something 
far more serious it would cause us distress. But 
generally in process plant running it is not a matter 
of subtracting one thing from another, it is a matter 
of just going over midnight into a new day and will 
not the plant generally not care whether it is 1 
January 2000 or 1 January 1900? Are there not many 
cases with process plant running, including the 
nuclear industry, when it is just a new day and if the 
plant thinks it is 100 years old when it is only five 
years old, it probably does not really matter too 
much? 

(Mr Eves) It matters if the software is double digit 
date dependent because that could lead to an 
unpredictable result. Iam going to ask Mr Bell to say 
a bit more about this because he is heavily involved in 
the technical investigations we are carrying out, but 
there is a difference I think between the kind of 
software that can run through the year 2000 which is 
generally four digit, you know 1999, 2000 four digit 
and software which on the whole is older and has 
been based on two digit. 


470. What I meant in my question was everything 
to be two digit. When I said 2000, I meant zero, zero? 
(Mr Eves) Right, okay. 
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471. And the plant does not know if the zero, zero 
has a 20 before it or if the zero, zero has a 19 before 
it. Mr Bell? 

(Mr Bell) I think the answer 1s that there is a high 
degree of uncertainty. We do not know. I will give 
you an example; we had a case recently of what are 
called smart sensors (analysers) which are basically 
micro-processor based instrumentation systems, just 
an instrument. And most instruments these days on 
process chemical plants are in fact micro-processor 
based. In fact, many duty holders may not appreciate 
that they have a small computer in the sensor. Now 
if you had looked at that sensor there was no reason 
why it should have any date dependencies 
whatsoever and yet when it was tested, it did fail on 
the year 2000, the reason being there was in fact a 
facility in the sensor to actually have a read out, a 
print out, if required. So in many of these things there 
are options in the systems which people can make use 
of and the issue is that over the years computer 
programmers have made use of these options. And 
this is the problem, that many of these things that 
have taken place have been possibly at the whim of 
an individual who wanted to make use of that 
facility. 


472. I actually interrupted Mr Beard. Please 
continue Mr Beard, but it does actually tie up with 
what you said, Mr Eves, that it is when one thing is 
dependent on another, you are not sure of that 
dependency? 

(Mr Eves) Yes. 


Mr Beard 


473. To continue what we are talking about, where 
there are dependencies on the date, time function are 
there low-tech back-up systems that will enable 
something else to take over if they fail at the critical 
time? 

(Mr Eves) You can always have a hard wired 
system to back up a—you know, micro-processor or 
whatever—an electronic system. Generally speaking 
I do not think that has been done. Again, I ask Mr 
Bell to give us the benefit of his experience. 

(Mr Bell) In many situations, particularly in the 
chemical area and off-shore, there is a layered 
structure in terms of the protection arrangements. 
For example, you would make sure in the design of 
the chemical plant or the off-shore installation that 
you had as much inherent safety built into the system 
as possible. You would then have probably some 
mechanical arrangement—possibly explosion relief 
or some release system which is mechanically 
based—and then in addition to that you would have 
an emergency shut-down system which could well be 
computer based. Now there are one or two 
situations, certainly at on-shore chemical plants, 
where you can only have one system; for example the 
production of ethylene could produce a detonation 
which means you cannot have a layered system. You 
have one protection system and that often has been 
done up to now in terms of either electro-mechanical 
or solid state electronic. Now, it could well be that 
there are some of those kinds of chemical plants 
which will depend totally to a high degree on a 
computer system. 
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474. With no back up at all? 

(Mr Bell) There would not be a back up, no. They 
will be in the minority but certainly that could be 
the case. 


475. Would they fail safe if they did fail? 

(Mr Bell) Those kind of situations tend to be 
designed by companies specialising in safety systems 
and it would be highly unlikely that they have not 
considered that, but again they would be the kind of 
things that we would be asking the duty holder to 
make sure, particularly in those sort of plants. 

(Mr Eves) If I could add, we are actually carrying 
out a survey through some consultants of plants of 
that very kind to establish the size of the problem. 


Mr Beard 


476. Have you, as the nuclear installation 
inspectorate, had plans to review from each of the 
nuclear installations or high risk installations so 
far—plans to prepare themselves for the millennium 
date change? 

(Mr Eves) Yes, our inspectorate wrote to all the 
operators last year, in fact, asking them specifically 
to demonstrate that they had an adequate approach 
to the year 2000 problem. Those replies have come in 
and we are assessing those replies at this moment. 
They give us no cause for concern, but the short 
answer to your question is yes, we did do that. 


477. To what extent so far are they adequate? How 
much are you having to go back to them and say: 
“This will not do’? 

(Mr Eves) They are adequate so far as nuclear 
safety is concerned. Like some other operators they 
have some work to do and they have a planned 
programme of work which they intend to complete in 
1998 to deal with those systems which are not related 
to nuclear safety. 


478. What are the criteria you will be judging them 
against in deciding whether they are adequate or not? 

(Mr Eves) We will judge them, I think, against the 
criteria that we have published. The methodology is 
explained in our guidance booklet, Safety and the 
Year 2000. In practical specific situations it is about 
seeing that if there is a failure mode it is a failure to 
safety without any further knock-on consequences. 
These things are comparatively easy to demonstrate, 
provided you have done the initial thinking and 
testing. So the hard work comes first. 


479. Would you be prepared, in a nuclear 
installation, if you were not satisfied that the plans 
were adequate or would be carried out in time, to 
withdraw the licence for that installation? 

(Mr Eves) We have various levers short of 
withdrawing a licence, but we can of course withdraw 
a licence. The levers I mention are modification to 
licence conditions. They are under constant review 
between the inspectorate and the operators in any 
case. We regard a nuclear site licence as a living 
document. Things move on and the licence needs to 
move on with it, so if necessary an inspector can enter 
a discussion with the operator and say that I am not 
convinced that what you are doing is going to be 
satisfactory and there is the ultimate threat of course 
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of the licence being withdrawn. I am confident that 
we will not need to reach that point because of the 
positive discussions we have been having with the 
operators. 


480. What would be the circumstances in which 
you would contemplate withdrawing the licence? 

(Mr Eves) It would have to be a situation in which 
we believed that nuclear safety was threatened with a 
risk to workers at the site or an off-site risk to the 
public. 


Dr Kumar 


481. May I just turn now to the chemical industry, 
Mr Eves? In your submission to this Committee you 
said you were providing guidance notes for the 
Chemical Industries Forum. Can you tell us if you 
have made any more progress since then? Is there any 
action you have taken since those guidance notes? 
Can you elaborate on the progress made so far? 

(Mr Eves) Chairman, with your agreement I would 
like to invite Mr Norris to comment as Mr Norris 
chairs one of our advisory committees. 


Chairman 


482. Mr Norris? 

(Mr Norris) Thank you, Mr Chairman. The 
Chemical Industries Forum is one of our operational 
committees where we bring together major 
companies from the sector and we issued guidance to 
them a few weeks ago and major companies are now 
assessing that guidance and we have a continuing bi- 
lateral dialogue with them to check that action is 
being taken. To get a firmer fix on the scope of any 
particular problems, we are surveying some 300 of 
the major sites at the moment and that work we think 
will be finished in June or July. So the next phase of 
the programme is that we will take stock in July with 
the Forum based first of all on the action they have 
been taking under their own survey results and check 
that things are under control. 


Dr Kumar 


483. Can you just elaborate on what actions you 
would be intending to take or what you intend to do? 

(Mr Norris) We have a team of specialist 
inspectors who are organised into what we call our 
Chemical and Hazardous Installations Division and 
they would be, I guess, in weekly contact with all the 
major players helping sort through the problems 
based on the methodology we have developed and 
published in our Safety and the Year 2000 report and 
they will deal with problems as and when they arise, 
often over the phone or over a video link or by means 
of a site visit. The check point will probably be in July 
when we will come together with the Forum again 
and take stock of what has been happening across 
the piece. 


Mr DaAvip Eves, CB, 
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Mrs Spelman 


484. It is quite a good summary question, I think. 
How content are you that all high hazard 
installations will be millennium compliant and that 
the health and safety of workers and others will not 
be put in jeopardy by business failure? 

(Mr Eves) I think here in March 1998 it would be 
wrong for me to say that we are fully content. I hope 
that we will be able to say that to you nearer the year 
2000. We do have a lot of work to do and so does 
industry have a lot of work to do. We believe that in 
the high hazard sectors, without exception, they are 
working along the right lines and they are dominated 
of course by companies with a lot of resource and 
access to a lot of expertise. My concern at this stage 
is with SMEs who could actually pose risks both to 
workers and to the public if something goes seriously 
wrong with one of their process control systems. 


485. What evidence do you have of that? 

(Mr Eves) We do not have very much evidence. I 
have to say that we have scoured the world for 
evidence of things going wrong and we have not 
come up with that much. Our research continues. We 
do know of an example in New Zealand where an 
aluminium smelter closed down inadvertently, 
fortunately without any major accident 
consequences, but with enormous economic 
consequences for the plant and that perhaps is an 
extreme case. We do know, in any case, without the 
Year 2000, that computerised systems can go wrong 
for the sort of reasons that Mr Bell was explaining 
earlier on. So maintenance of this software where it 
is controlling plant with possible safety implications 
is always a major thing for us to talk about when we 
are inspecting plants. I think the Year 2000 problem 
has brought it into much sharper focus. 


Mr Atkinson 


486. Come midnight on Friday 31 December 1999 
while a lot of people will be celebrating informally, 
officially, the local government will be organising 
their own thing; there is, I understand, money 
available from the millennium fund for such events. 
Yet we understand that more and more insurance 
companies are refusing to cover the holding of those 
events because of what might happen at midnight. 
What thought has been given to this? Who will be 
liable? 

(Mr Eves) Well it is news to me that insurance 
companies are refusing to cover events of that kind. 
I was not sure in any case that it was easy to get cover 
for what sounds like a party, but I can see the 
seriousness of your question. I do not think the 
Health and Safety Executive is the sole player in this 
business. We will do our part and we are not actually 
planning a party of our own yet, but we would I hope 
be part of the general activity from Government 
which alerts people to the problem. Discussions with 
the insurance industry I think are probably 
something that we would want to get into ourselves 
for our own purposes, and although I cannot answer 
your question directly today, Mr Atkinson, I will 
take it away and pursue it elsewhere. 

Chairman: One final question from Mr Jones. 
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Mr Jones 


487. May I just ask about gas storage? It is an issue 
which came to my attention last evening when I had 
a very fine dinner with Transco. Around the country 
we have gas storage devices, some of them the old 
fashioned gasometers, some of them—I think there 
are 12 installations across the country—big gas 
bullets, which are socking great hundred metre long 
things that are 20 feet high which store gas under 
pressure. Now I have one of these in my 
constituency—which is why it was brought to my 
attention—and nobody actually works on site. These 
are monitored from elsewhere and of course it has a 
consultation area around it so that if any planning 
applications come in the local authority has to ask 
you to comment on those issues. Are you planning 
anything for installations like that, to inform 
residents living nearby, because of course you have a 
turnover of residents moving in and out of houses? 

(Mr Eves) We are involved with Transco and we 
know that they set up a project team about a year ago 
to deal with their Year 2000 problem. We are also 
involved in the local planning process in that 
planning authorities can consult HSE and we can 
give them technical advice. The sort of installation 
you describe is unmanned, but is in fact likely to bea 
major hazard installation with which we will have 
some familiarity and the safety case regime for gas 


Mr DaAvip Eves, CB, 
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supply does require us to verify the proposals for 
safety that the network controller, which is effectively 
BG Transco, has over the whole system. Mr Norris 
is responsible for policy in this area and might be able 
to add a bit to what I am saying, but the short answer 
to your question, Mr Jones, is that we are involved 
in that kind of situation and if you have concerns or 
constituents have concerns, we are happy to deal 
with them. 

Chairman: Thank you, Mr Eves, Mr Norris and 
Mr Bell. We have come to the end of our time. You 
have been very helpful in giving us answers to our 
questions. I think you have given us a degree of 
reassurance, but as you yourselves have said, you still 
have another 20 months to go and there is a lot more 
work to do in that time. You have told us that many 
of the problems you are aware of, you are working 
towards solving the problems and you also assured 
Mr Beard that in the event of people not working in 
the direction you want them to, there are sanctions 
you can take against them and would not hesitate to 
do so. We wish you well in what you do, because we 
all depend upon the success of your work. We shall 
take note where the members of your staff take their 
Christmas holidays in 1999. If too many of them are 
going abroad, Mr Eves, we may go abroad, too! 
Thank you very much for your help. 


Memorandum submitted by the British Bankers’ Association 


THE BRITISH BANKERS’ ASSOCIATION 


1. The British Bankers’ Association (BBA) is the trade association for more than 300 banks from over 60 
countries which operate in the UK and is the principal trade association for the banking industry in this 
country. We welcome the opportunity to submit evidence since the issue has major implications for banks, 
their customers and for the country’s financial infrastructure. 


SUMMARY 


2. The Year 2000 issue is of critical importance to banks and to the national economy. Banks and the UK 
payment systems on which they and their customers depend are making considerable efforts to ensure their 
own compliance. However, demands on scarce resources are considerable. There is also serious concern about 
lack of action in the small and medium sized business sector and overseas, North America apart. Banks are 
doing what they can in these areas and we welcome our involvement with Action 2000. 


3. The Year 2000 problem is not just an IT matter but is a major business issue, which can only be solved 
by businesses themselves. However, the Government should continue to take a strong lead in raising 
awareness of the issue; in urging other governments to give it higher priority, to ensure that its own house is 
in order; and to ensure that the utilities and infrastructure on which the country relies will be compliant. 


THE SCALE OF THE PROBLEM 


4. It is difficult to exaggerate the scale of the impact on banks and through them the UK economy if they 
and their customers and counterparties both in the UK and abroad are not Year 2000 compliant. The 
problem, although essentially simple, is all-pervasive and is exacerbated by the complexities of 
interdependence of banks amongst themselves and with their counterparties. It is estimated that tackling the 
problem will cost banks in the UK approximately £1 billion. 


5. Banks are on target to overcome these problems. To indicate the scale, however, if the problem is not 
solved in the core nationalypayment systems, it would mean that the vast majority of salaries, pensions and 
all direct debits/standing orders would not be paid. The inter-bank CHAPS system moves the equivalent of 
a year’s GDP about every six days. Payment systems failure would also trigger a systemic risk. Non- 
compliance of a bank’s counterparty or customer may lead to that customer’s failure and to a consequent 
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lending risk and/or a risk to investors such as pension funds. The impact of data corruption on, for example, 
interest calculations or payments would cause untold aggravation to customers whether business or private 
and would also involve substantial time and disruption in resolving problems which arise. Other risks include 
failure to meet market contract deadlines, inability to access market data and the need to amend and test the 
often complex spreadsheets which banks use to price their wholesale markets business. 


6. There are also significant implications for banks if business customers are seriously disrupted or even 
go out of business because of Year 2000 problems. Within supply chains, the failure of one business could 
have a domino effect on its customers and suppliers. These could be compounded where supply chains work 
on “just in time” deliveries, so that the failure of a supplier could quickly halt production at its customer and 
the effects would then spread to other suppliers. Banks are co-operating to ensure business customers are 
taking the necessary action because they recognise that the failure of one bank’s customer could disrupt or 
bring down the customers of other banks, leading to losses for all. 


ACTION TAKEN TO AVERT THE PROBLEM 


7. The major banks have been working on the problem for at least 2-3 years. In March 1997, following 
consultation with banks and the Bank of England, the BBA published a recommended timetable and 
guidance for compliance (Annex 1). The process involves audit, recording, impact analysis, resolution and 
testing. A survey of member banks in May 1997 indicated that awareness was very high, Year 2000 
coordinators and related teams had been established and all expected to be compliant well before 2000. The 
key date in the timetable is 31/12/1998 by when it is recommended that banks will have completed testing of 
major systems, including external testing with outside organisations. In practice many will be undertaking 
external testing, particularly with the major UK payment systems in the second quarter of 1998. 


8. However, as with other industries, banks are heavily dependent on third party suppliers in the IT 
industry to provide solutions. Resolution does not lie entirely within banks’ hands. 


9. Substantial effort is going into raising customer awareness and examples of the material banks have sent 
to customers are attached. Managers are also undergoing special awareness training and questions about 
compliance form part of regular reviews with business customers. Banks are working to identify higher risk 
sectors and may make more detailed enquiries of customers in those sectors. 


10. We are also looking to develop, through Action 2000, the possibility of a “National Checklist”. This 
is a self assessment checklist to help guide businesses through the work needed to get them ready for Year 
2000. It would also form the basis for discussions about progress to compliance between a business and those 
likely to want to assess its progress, eg auditors, insurers, major customers, bankers, shareholders and 
regulators. We are trying to get as many of these groups as possible to agree a core set of questions in a 
checklist. This should help businesses and avoid them being faced with a number of similar but annoyingly 
different questionnaires from such groups. 


11. The BBA has been instrumental in the setting up by the Bank of England of a City 2000 forum 
comprising representatives of the financial services industry to exchange information, report on progress, 
highlight and resolve problems and consider such issues as industry-wide testing. 


12. Internationally, the BBA, through the European Banking Federation, has been seeking to increase 
awareness and assess compliance within other countries’ banking industries. However, we do not have the 
resources to gather detailed information on the state of readiness in each country, which is what is needed. 


THE ROLE OF GOVERNMENT 


13. We welcomed the role of Taskforce 2000 in raising awareness and the creation of Action 2000 (of which 
we are a member) to move the agenda on. This will be helped when it appoints a full time Director. We support 
the direction Action 2000 is taking in the urgent establishment of one-stop sources of information for 
businesses and moves to increase the supply of skilled resource in the short term. 


14. We believe, though, that in addition, Government has an important role to play in: 


(a) influencing other governments and urging them to give the problem the priority it requires. It would 
also bea great help if the Foreign Office could use its network of embassies and consulates to provide 
regular information on the state of preparedness overseas, which Action 2000 could publish; 


(b) ensuring compliance of the major utilities which comprise the nation’s infrastructure and that 
information on their compliance is published through Action 2000 to avoid innumerable wasteful 


enquiries; 
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(c) minimise as far as possible legislative and other regulatory changes which will increase the enormous 
burden which Year 2000 is putting on the private sector. In addition to Year 2000, banks are having 
to devote considerable resource to preparing for EMU, adjusting to the requirements of the new 
regulatory regime and preparing for the new ISAs. Many are having to divert resource to Year 2000 
by suspending their own competitive product development. 


(d) leading by example by ensuring early compliance of its own systems and providing more openness 
on progress. 


EXTENT TO WHICH NEW SYSTEMS AND SOFTWARE ARE MILLENNIUM COMPLIANT 


15. New systems continue to be supplied by manufacturers and retailers which are non-compliant. These 
include some which may purport to be compliant. At a time when there is pressure on businesses to act, it is 
vital that those who choose to replace their hardware and software are given unambiguous compliance 
information about what they are buying as replacements. The imminence of Year 2000 means that non- 
compliant systems supplied now ought to be declared unfit for their purpose under the law. The IT industry 
ought not to force customers to purchase upgrades of package software by refusing to make existing systems 
compliant free of charge. 


16. One particular concern is that some smaller software houses which have supplied non-compliant 
systems do not have the resources to cope with the remedial work. There is a real fear that a number will opt 
to liquidate their business rather than incur liability. 


CONTINGENCY PLANS 


17. Banks which are advanced in their plans for resolving the problem are now preparing contingency 
plans. The BBA, in conjunction with APACS, will be consulting banks shortly to establish best practice to 
cover the contingency of a counterparty bank being temporarily unable to operate after 1 January 2000. 


18. Contingency planning has highlighted two key differences between Year 2000 planning and standard 
disaster recovery. First, standby IT sites may not be usable if the prime site fails due to a Year 2000 problem, 
because the probability is that the problem is not localised and the standby site will have the same problem. 
Second, if the failure is caused by problems on customised software, alternative software will not be readily 
available. Resorting to “pen and paper” could be a huge operation. 


19. Given the structure of IT systems, it is unlikely, in the event of a disaster, that alternative software will 
be available. 


LEGAL ISSUES 


20. There is widespread agreement that litigation is not a solution. Businesses cannot afford to wait until 
1 January 2000 and then rely on litigation to deal with any problems. 


21. The prominence given to legal issues and threats of litigation has inhibited the degree of openness and 
co-operation which is needed to resolve the problem. This is particularly true in the field of certification where 
directors, fearful of their liabilities, have sought rigorous compliance certification processes from customers 
or suppliers but, when faced with similar requests themselves, have couched their answers in the blandest 
terms. It is now increasingly recognised that there is no prospect of an independent, robust compliance 
certification process. There is evidence that, instead, firms are opting for a more constructive approach, 
involving a dialogue with key customers and suppliers to help them understand their position and plans. This 
allows more informed management decisions than relying on contract clauses and/or future litigation. The 
“National Checklist” mentioned in paragraph 10 above could help this dialogue. 


MAJOR CONSTRAINTS 


22. The major constraints are shortage of skilled labour and time, not only within banks but in the software 
industry. This is a particular problem amongst medium sized businesses. Many small firms rely on stand- 
alone PCs and package software, and so Year 2000 problems are largely containable and should not result 
in failure of the business. Medium sized companies tend to have networks, customised systems and external 
electronic linkages but tend not to have significant in-house IT resources they can assign to the problems. 


23. The shortage of skilled staff able to tackle the problem is increasingly driving up the cost. We welcome 
Action 2000’s efforts to facilitate the creation of a skills pool to alleviate this problem and to establish fast- 
track technical training. 


24. The innumerable sources of information on the Year 2000 problem create something of an information 
overload which is difficult for SME’s to navigate. We therefore welcome Action 2000’s plans to create one- 
stop information databases for SME’s. 
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25. The absence of independent, robust means of assessing compliance is compounded by the 
impracticality of establishing full “end to end” testing of international systems. A large electronic payment 
by a Singapore importer to a British exporter might be in US dollars and the transactions to deliver sterling 
to the British firm might, literally, circle the globe and be dependent on a host of local systems and gateways. 
Ideally, all those local systems and gateways would be linked and tested together but there is insufficient 
international agreement to achieve that. 


CONCLUDING REMARKS 


26. Whilst banks are devoting huge resources to ensure that they will be fully compliant and are doing their 
best to raise awareness in the business community they serve, there are four areas which threaten the success 
of this effort: 


— the inadequate level of action in the UK, particularly amongst SMEs; 

— lack of action internationally, especially in Europe where EMU has been given highest priority; 
— the lack of resource within the IT industry to deliver solutions to an acceptable timescale; and 
— the need to ensure that major utilities are compliant at an early stage. 


We urge Government to do all it can to alleviate these key concerns. 
J R W Thirlwell and M C Young 
2 December 1997 


Annex 


PLANNING FOR YEAR 2000 


The ability of computer systems and other electronically-controlled mechanisms to handle dates in the next 
century correctly is a major issue for all businesses. It is particularly important for financial institutions that 
the industry’s reputation for safety and reliability is not prejudiced by the failure of any part of the electronic 
infrastructure, nor by speculation about such an eventuality. Banks will already have established a Year 2000 
project but, by setting out emerging best practice covering the whole process, industry coordination will be 
facilitated and any systemic risk reduced. 


The BBA, in consultation with APACS, the Bank of England and a range of Member Banks, has drawn 
up the following guidance which it recommends as a high-level framework for Members. With the support 
of all Members in ensuring that systems are checked, amended if necessary and tested both individually and 
in conjunction with others, the BBA will be able to take positive action to rebut “millennium meltdown” 
speculation relating to the financial sector. In particular, an outline timetable is recommended so that cross- 
bank and other third-party testing can be undertaken in a timely manner. 


Banks have an interest in ensuring that their customers have taken timely action to address their own 
possible system problems and we suggest that this should form part of regular credit reviews, if not already 
incorporated in them. 


The extent of legal liability of suppliers for millennium-related failures is uncertain and banks should review 
contract terms to establish their position both as purchasers and vendors of services. 


BACKGROUND 


Virtually every organisation will have its computing operations affected in some way by the rollover of the 
two digit year value to 00. The majority of computer operating systems and programs currently in use have 
been developed using six digit date fields (YYMMDD). For example, 31 December 1999 would be 
represented by “991231” in computer code. The two digit field for the year (in this example “99”) is the basis 
for all calculation formulae within many computer systems, particularly those processed through mainframes 
although PCs are also affected. 


Until now, this two digit field has sufficed, using a subtraction of current date from some future date (up 
to 31/12/99). As the industry enters the year 2000, the two digit field “00” will not permit consistent 
calculations based on current formulae. 1 January 2000 would be held as 000101 and many computer systems 
will recognise this date as the year 1900. The potential impact is that date-sensitive calculations would be 
based on erroneous data or could cause a system failure. This affects all forms of financial accounting 
(including interest calculation, due dates, pensions, personnel benefits, investments and legal commitments). 
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It can also affect record keeping, such as stock, maintenance and file retention. Many devices are controlled 
by micro-processors (for example, lifts, security systems, cash dispensers and telephone exchanges) and these, 
too, could be affected, even if date processing appears peripheral to their operation. 


The recommendations below provide a framework for ensuring that banks, and the banking system, 
continue to function smoothly into the year 2000 and beyond. 


RECOMMENDATIONS 


1. Banks should establish a Year 2000 Team headed by a very senior manager with authority to obtain the 
necessary resources, both IT and business, to identify, address and resolve all Year 2000 issues. It should be 
noted that this is not purely an IT project: . 


— amending code may not be the most cost-effective way to address each problem. In some instances 
with short date cycles, a short-term manual work-round may be effective; in others a decision to 
stop using the system or device may be less costly than making the changes. 


— scarcity of IT resource may mean a prioritisation by business impact has to be made. Such decisions 
cannot be made by IT alone. 


— Each business needs to assure itself that problems identified have been satisfactorily fixed by 
participating in the testing; if the test results are negative, businesses will need to undertake impact 
analysis and contingency planning. ; 


2. An inventory of all computer operating systems, applications and files, and electronically-controlled 
equipment should be created. All those with year 2000 issues need to be identified. 


3. A comprehensive Year 2000 plan for addressing the issues identified should be mapped out. 


— The initial step in developing the plan should be to consider whether current systems and files should 
be modified, replaced, outsourced, or discontinued. Modification may consist of expanding date 
fields or of inserting inferential logic code to decide to which century a two-digit date belongs. It 
should be noted that even if new systems are purchased, old files may still have to be modified. (All 
computer systems, including mainframes, personal computers, local area networks, etc, should be 
considered.) 


— The plan should also identify and prioritise applications and processes that are the most date 
sensitive and those which are most vulnerable. Interdependent applications should be grouped 
together. 


— Where computer systems or other products are provided by service bureaux, hardware or software 
vendors, or other third parties, banks should request those external vendors and service providers to 
provide Year 2000 conformity (see below) within the testing deadlines below; and make contingency 
arrangements to ensure that critical operations will continue if the external supplier is unable to 
achieve millennium conformity. 


4. The timetable is such that the inventory of systems and equipment should already (March 1997) have 
been completed, issues should have been identified and a plan addressing the issues agreed, incorporating the 
following target deadlines: 





31 December 1997 Relational systems (transaction-processing and other systems with external 
interfaces) upgraded (modified, revised or replaced as appropriate) and available 
to test in order to meet the next deadline. 

Compliant platforms available to test. 

30 June 1998 Relational systems tested and available for cross-organisational testing, including 
those from third parties. 

Stand-alone systems available to test. 


31 December 1998 Relational systems cross-organisational testing completed and upgraded systems 
implemented. 
Stand-alone systems tested and upgraded versions implemented. 

30 June 1999 All other equipment upgraded and tested 





This timetable leaves the year 1999 for final trials and contingency planning. 


5. The plan should be implemented within the bank’s framework for systems development. Slippage in the 
plan should be closely monitored and addressed, either by allocating extra resources where feasible or by 
seeking alternative solutions. Late delivery is not an option on this occasion. 
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6. The definition of Year 2000 conformity prepared by British Standards Institute technical committee 
BDD/1/-/3 (document reference DISC PD2000-1) should be used: 


“Year 2000 conformity shall mean that neither performance nor functionality is affected by dates 


prior to, during and after the year 2000. 
In particular: 


Rule 1 No value for current date will cause any interruption in operation. 
Rule 2 Date-based functionality must behave consistently for dates prior to, during and after 


year 2000. 


Rule 3 Inallinterfaces and data storage, the century in any date must be specified either explicitly 
or by unambiguous algorithms or inferencing rules. 


Rule 4 Year 2000 must be recognised as a leap year.” 


Examination of Witnesses 


MR TIM SWEENEY, Director-General, MR MICHAEL LEwIis, Deputy Chief Executive, Association for Payment 
and Clearing Services, and Mr MIKE YOUNG, Assistant Director, British Bankers’ Association, were 


examined. 


Chairman 


488. Order. Mr Sweeney, Mr Lewis, Mr Young, 
welcome to the Science and Technology Select 
Committee. You know the inquiry we are 
undertaking; the one into the computer compliance 
for the year 2000 and we look forward to the help and 
assistance you are going to give us this afternoon. Mr 
Sweeney, would you care to start by perhaps 
introducing yourself and your two colleagues to the 
Committee? 

(Mr Sweeney) I am Tim Sweeney, the Director 
General of the British Bankers’ Association which 
provides representative services for all 330 member 
banks operating in the United Kingdom. On my 
right is Michael Lewis, who is the Deputy Chief 
Executive of our sister association, the Association 
for Payment and Clearing Services which looks after 
the shared infrastructure of the payment system in 
principle, and on my left is Michael Young who 
works with me at the BBA, particularly on risk 
management and small firms. 


489. Thank you, Mr Sweeney. We have heard 
various stories with regard to banking including the 
possibility that people will not be able to draw money 
out of the bank on New Year’s Day 2000. I wonder if 
you could tell us what in your opinion are the greatest 
challenges facing the banking industry in relation to 
this particular problem? 

(Mr Sweeney) Yes, certainly. I do not think there 
are any challenges which are unique to banking 
which are not shared by other sectors of the 
economy. The primary concerns are the main 
systems and making sure that the coding errors 
within those systems are corrected and that any 
problems with embedded chips are corrected. That 
will be familiar to the Committee. There is nothing 
else which is intrinsically different about banking. 
What is intrinsically different about banking is the 
nature of its business and the consequences of 
anything going wrong, but I think the important 
thing that I want to get across to the Committee is 
that the banks have identified the nature of this 
problem, identified it sufficiently far in advance and 
have done a great deal of work in planning the way 
in which we will tackle the problem and we have as 
much confidence as one can have—there is no 


guarantee in this area—that the problems will be 
solved and that the systems will be operating on | 
January. 


490. What is the worst type of failure there can be 
in a banking system? If I cannot get money on 1 
January in the year 2000, but Iam promised I can get 
it the next day, I probably will not be too distressed, 
but if I am told there is not going to be any for three 
weeks because the accounts are all just up in the air, 
it is going to be quite a serious problem. What is the 
worst case scenario in regard to the banks? 

(Mr Sweeney) I do not know that I can answer 
that, Chairman. The worst case scenario depends on 
who you are and what the nature of your business is. 
If you have a business transaction to settle on 1 
January 2000, not having access to your bank 
account is a disaster. We have approached it a 
different way. We have approached it from the 
perspective that it is important that as far as possible 
all the central and critical elements of the banking 
system are working on | January in the year 2000. We 
have not asked ourselves what sort of disasters might 
befall us if we get that wrong. That does not betoken 
complacency, but it does betoken the degree of 
importance that banks attach to this problem and the 
extent of resources they are putting in as individuals 
and in our representative associations. 


491. Are your member banks sharing information 
in a wise and mature fashion? 

(Mr Sweeney) The answer to that is yes. They are 
certainly dealing with this in a co-operative fashion. 
Within the central payments systems—and Michael 
Lewis might say a word about that in a second—I 
think there is absolutely no doubt that there is a high 
level of sharing within the mainstream business of 
banks. Of course there is a competitive element and 
there is a limit to how far banks will share 
information, but where they have identified that the 
issue or the solution of a particular issue is core to the 
industry as a whole, then yes, they are sharing 
information responsibly. 


492. You want to bring Mr Lewis in, but before 
you do, I have a last question before we go to other 
Members of the Committee and perhaps you could 
answer both of them. You did say in your 
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memorandum last December that you were on target 
to overcome the problems that you had found. Is that 
still the case? Are you still on target? May I ask you, 
Mr Lewis or Mr Sweeney first and then Mr Lewis? 
(Mr Sweeney) If I may answer for the broad 
industry, as you know we set out a schedule by which 
people should have done various tasks. We are 
currently surveying the market to see whether people 
still anticipate being able to meet the 31 December 
1998 target, which is the next critical one. Answers 
are still coming in, but we have sufficient information 
to be confident that what I call the heartland, the big 
High Street banks, the names that you will know, will 
be on track and are likely to meet that deadline. 
There will be a few outlyers and we will chase those 
vigorously, but we would think that something like 
well over 90 percent of the banking business, the 
institutions representing between 90 and 95 percent 
of the banking business of the United Kingdom, will 
meet that target. 


493. Thank you very much. Mr Lewis? 

(Mr Lewis) Thank you, Chairman. May I just echo 
what Mr Sweeney said. I think in connection with the 
competitiveness, banks initially wondered whether 
this was not a competitive issue but they very quickly 
discarded that and I think there has been an 
extremely high level of co-operation. They have come 
to understand the mutuality of interest in getting this 
right in the interests of themselves and of course their 
customers because of course their business is their 
customers’ business and a failure of any one would be 
a failure, I think, perceived by the customers to be 
one of everyone. I think as regards the targets, we 
have set ourselves very demanding targets in order to 
allow slippage, to be frank, and the aim of the 
payment systems is to be compliant in all respects and 
tested by the end of 1998 at latest. That reflects a very 
sober, hard-edged assessment of what we have to do 
in order to allow inevitably for the slippages that will 
occur in one or other programme. For the moment 
we are on time. The actual internal testing of the 
central interfaces should be completed by the first 
quarter of this year, which then leaves the next three 
quarters of this year for the integration testing of the 
systems as a whole. I think it would be quite 
irresponsible to suggest that nothing is ever going to 
go wrong in this, but we have left ourselves I think 
sufficient time to recover and we are on timetable to 
do that. 

Chairman: Very impressive, Mr Lewis. Mrs 
Spelman? 


Mrs Spelman 


494. In your evidence to us you have given an 
estimate of the total cost of compliance programmes 
being of the order of £1 billion. To what extent will 
these costs be passed on to the customer? 

(Mr Lewis) Could I pass this question to Mr 
Sweeney who is more concerned with the customer. 

(Mr Sweeney) The answer is we have talked about 
£1 billion. You have to put that into perspective of a 
very large sector and the operating costs of the sector 
as a whole are about £20,/Willion a year; there are 
other statistics, but I will not bore you with them. It 
is not a critical amount. The second point to bear in 
mind is that there are—a question we might come on 
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to later—a limited number of resources available to 
do this sort of work and in large measure the way our 
industry is coping with it is diverting from other 
projects. So it is not an additional cost; it is a shift. 
The third factor to bear in mind in relation to those 
two is that in a hotly competitive banking market like 
we have in the United Kingdom, the supplier simply 
cannot manipulate the price. It will be set by the 
market, not by the underlying costs themselves. So 
the answer to your question I think pretty certainly is 
no, not in any realistic way. 


495. What does this figure include? Does it for 
example include some of the valuable work that you 
have been doing with your customers to help them to 
prepare for the date change? 

(Mr Sweeney) No, I think—and Iam sorry to clash 
with my colleague—the £1 billion 1s the pure internal 
cost of manipulating the systems. 


496. Often it is the experience of other 
organisations and other companies facing the same 
problem that they find the costs of this compliance 
work tend to escalate above the original estimate. 
How reliable do you think your figure of £1 billion is? 

(Mr Sweeney) I think it is reasonably reliable 
because time is marching on. We are in 1998 now, so 
people’s minds are focused very, very closely on this 
issue and they are having to ask themselves what 
projects they are going to have to forego and they are 
having to make important decisions about the 
allocation of resources. So people have thought 
about this; it is not finger in the air. This is people 
thinking about it. Some banks you will no doubt 
have seen have announced in their published results 
what amount they are provisioning for the Year 2000 
work. Those can be slightly misleading because 
sometimes they are grouped rather than specifically 
for the United Kingdom. But no, people have 
thought seriously about this. There is a problem— 
and it relates back to what Mr Lewis was saying— 
that of course as you get up to the end of a 
programme things happen that you did not 
necessarily expect. There is a certain element of 
conservatism that one would want to build in, but I 
think that is broadly an accurate figure. 


Dr Kumar 


497. To earlier questions, Mr Sweeney, you said 
that you felt 90 percent of the banks would meet the 
target. Now obviously you are quite confident you 
are going to meet that target and so forth. Tell us 
what leads you to believe that you are actually going 
to meet that target and obviously to what extent your 
members are responding to the timetable that 
obviously you feel they are going to deliver in the end 
and how are you monitoring this? 

(Mr Sweeney) | think that the confidence really 
stems from one very simple fact. They are very 
conscious that if they do not meet it their business is 
in serious trouble. This is unlike some other issues 
that face banks; this is potentially a life or death issue 
so they are working at it, let no-one be in any doubt 
of that at all. If there were no internal dynamics of 
that nature then of course there is the issue of the 
supervisors and regulators of the banking and 
financial services industry who will inevitably, as the 
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time moves on, take an interest in banks’ progress 
because there are real risks for customers if banks do 
not get it right, so there is an external dynamic. As far 
as our own role is concerned, we are a trade 
association so we are not a police body. I cannot tell 
my members what to do. We have published the 
timetable which was endorsed by our Council. We 
check on a regular basis whether they continue to 
believe they are meeting that target and we exhort 
them, we explain to them, we have a vigorous 
working group, we also have a contact group. There 
are a lot of means of communicating with the 
industry and periodically I write, as I just have done, 
to the chief executives of major institutions drawing 
their attention to the importance of the issue. 


498. How regularly do you monitor this? Every 
two months, every three months? 
(Mr Sweeney) No, it is every six months. 


499. Every six months, and that you think is 
sufficient to monitor the progress? 

(Mr Sweeney) I think with the regular reminders 
through our newsletter and through other industry 
circulars that come particularly from the work that 
Mr Young does, yes. This is not an issue which is on 
anybody’s back burner. I think I would merely 
irritate my members if I rang them up every week or 
every month or so and said: “How is it going?”. The 
answer is it is going, because they are worried 
about it. 

(Mr Lewis) We have a rather simpler environment 
in the clearing companies because of course there are 
only some 20 banks involved directly as members, 
but just to pick up the points that Mr Sweeney was 
making, each of the clearing companies has an audit 
procedure and is requiring regular certificates from 
each of the members that they are complying with the 
requirements of the companies at approximately 
three-monthly intervals. What we have also done is 
set up an overview body, which I chair, called The 
Forum which is responsible for the overlaps and 
underlaps and to ensure in particular that testing has 
actually been conducted according to schedule. So 
there is an interactive means of supervision there. 
Each of the companies has also had an external 
validation of their test programme to make sure that 
it is realistic and that it will deliver on time and within 
the budgets that they have set. Again, this is an 
appropriate mechanical process; one cannot 
guarantee that all the results will be perfect, but we 
are trying to make very sure that no balls escape us, 
in the knowledge, as I think Mr Sweeney has said, 
that this is a central concern. If we do not get this 
right, the banks are dead in the water. It is not an 
option. 


Dr Jones 


500. Could you take any action if one particular 
organisation was not meeting their responsibilities? 
What would you do? 

(Mr Lewis) Is that a question for me or Mr 
Sweeney to answer? 

(Mr Sweeney) Well, it depends. If you are asking 
about individual banks, we as the Association, no. If 
you are asking about the clearing companies that 
may be different. 
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(Mr Lewis) Yes. We can and will take direct action. 


501. And what sort of direct action? 

(Mr Lewis) The first actions will be by the Audit 
Committee of the Board. There is a very effective 
form of peer review in this which is not at all a 
gentleman’s agreement. It is a very severe scrutiny of 
companies’ actions as indeed it is of their individual 
operations during the operations of the clearing 
company. There are very clear service level codes 
which they must adhere to. I suppose ultimately it 
would be possible for a bank to be expelled from a 
clearing company, but I think we would regard that 
as the weapon of last resort. 


502. You have been involved with the setting up of 
City 2000. To what extent are you duplicating—are 
you doing the same sort of job as they might be 
doing, as Action 2000 might be doing? Is this a useful 
mechanism? There do seem to be lots of 
organisations being set up and there is a worry that 
there is duplication which will actually obfuscate and 
make people wonder. On a specific example, I was 
interested in your checklist that you developed. You 
said in your evidence to us that you were working 
with Action 2000 to develop that checklist. Has your 
checklist been approved by them? How is it being 
disseminated? For example, I checked the website 
which was being promoted by the CBI—you know, 
the bug campaign—and there was no checklist on 
that site about a week or so ago when IJ checked. So 
how much progress has been made? I would have 
thought that was very important, coordination of 
checklists for a particular—perhaps general ones for 
everybody and perhaps with additional questions 
specific to different types of industry? 

(Mr Sweeney) I think if I could deal with the 
overlap problem first, the difficulty with this is it is no 
single one body or person’s problem, so there is no 
single one body or person to take control and say: 
“We will coordinate all this”. What we have found is 
that, by and large, each separate strand of 
development and coordination and co-operation has 
been useful on its own and there is an increasing 
tendency for them to overlap and to become 
constructive. We have worked with a number of 
other bodies ranging from Action 2000, but also 
critically within the City with the Bank of England 
who are now chairing a group which is City wide, and 
I think my own view—and I would ask my colleague 
because he 1s closely involved—is that the level of co- 
operation is actually constructive and helpful and 
there is an element of duplication, but it is inevitable 
within the system and it does not get in the way. On 
the checklist, our view is that a national checklist 
would be helpful. The problem is that there are a lot 
of differentiations in different sectors and someone 
would have to sit down and work very, very hard to 
define clearly what a national checklist would 
actually look like. We may be getting to the point 
actually when it is a bit too late anyway. We are now 
in 1998 and a lot of work has already been done and 
needs to be done. Our checklist we have made freely 
available; it is used by a number of different people 
and I think it has generally been regarded as helpful. 
We devised it for a particular purpose in relation to 
small businesses. If I may, Chairman, I would ask my 
colleague to comment? 
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503. Yes. Mr Young? 

(Mr Young) Thank you, Chairman. As Mr 
Sweeney has said, we still believe that the idea of a 
national checklist would be helpful to businesses who 
are going to face a lot of questions over the next 18 
months from lots of different people. We still believe 
that the checklist that we have developed can be 
helpful to a lot of bodies who are maybe thinking of 
developing those checklists, but as Mr Sweeney has 
said, we lack a single body that we can go to and say: 
“Now here is our checklist. If this could be endorsed 
as the national checklist then everybody does this.” 
There are a variety of people who would need to take 
it on board for it to have a true value with businesses. 
We are pursuing those discussions, but we have not 
held back on our checklist. We have made it freely 
available to people. If as a result it does not turn into 
a national checklist but becomes a common checklist 
or if other people crib 90 per cent of it and use it as 
their checklist that, I think, will be helpful and we are 
not asking for any acknowledgment or copyright. 


Dr Jones 


504. It did strike me as a very useful list and J think 
it is very worrying that it is now March and you 
raised this in your submission in December as an 
issue and there does not seem to have been any 
progress on it? 

(Mr Young) There has certainly been less progress 
than we would have liked. Our target was to have 
something ideally by March because as Mr Sweeney 
has said— 


505. It comes too late? 
(Mr Young) Yes, the clock is running on this. 


506. Could I just get a quick one in on relation to 
the costs? Am I reading you right when you are 
saying that with the £1 billion pound cost, there is not 
going to be any extra cost in that that money is going 
to be found by not spending in other areas, so there 
will not be any actual additional costs by your 
members as a result of this? 

(Mr Young) In principle, yes. Individual houses 
will behave in different ways of course, but in 
principle we expect that it will be found by 
substitution from other work. That is simply because 
of the scarcity of resources to deal with the problem. 


Mr Jones 


507. You point out in your memorandum to the 
Committee that you have other things on your plate 
besides the millennium. What priority is the banking 
sector placing on millennium compliance projects 
compared to other essential IT developments like 
preparation for EMU or EMU issues or compliance 
with the new regulatory regime? 

(Mr Sweeney) I think that is unambiguous. This is 
the highest priority because it is the only one which is 
a genuine matter of survival. People will hope to be 
able to continue to progress their business needs, but 
there are real constraints. One of the points that we 
have made in several different environments, 
something which is very much in the hands of the 
public sector, is that it is terribly important that over 
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this next vital two years that the public sector keeps 
the demand for systems changes down to a 
minimum. For us that means in particular the 
regulators, the Inland Revenue, people of that 
nature, because if we have to divert significant 
resources as a matter of law or regulatory 
requirement away from this vital project, then we are 
in trouble. This is the highest priority. 


508. That came through loud and clear in your 
memorandum as well as the words you have given us 
today. Would delaying the introduction of some or 
all of these other issues help the compliance issue? 

(Mr Sweeney) The one which is key: and which 
presumably is in your mind is the single currency and 
I think the answer to that is no, depending a little bit 
on the Government’s intention which is not yet made 
clear in terms of timing. The first and most important 
priority for the industry has been to prepare the 
wholesale market level and that we have done. There 
is work continuing, but the bulk of the spend has 
been done and that is a much more simple project. 


Chairman 


509. Please explain what wholesale means in this 
sense? 

(Mr Sweeney) That really means the provision of 
the inter-bank payments mechanisms, much of which 
run through APACS, but also the provision for 
ability to offer services to large corporate customers. 
The really big systems cost is in the retail market and 
what we have said to the Chancellor in his working 
parties is that we do not believe we could start any of 
that work until after the year 2000, until this project 
is out of the way. 


Mr Atkinson 


510. Is there not some legislation or regulation or 
EU Directives which you have specifically said can be 
postponed or suspended because they would impede 
the essential paramount progress form in any 
compliancing? 

(Mr Sweeney) I do not believe we have made any 
such specific statement in terms of individual 
directives, no.’ 


511. It might have been helpful if you had, because 
it might add some weight and influence? 

(Mr Sweeney) There are not many—and I am 
thinking very rapidly—directives which I am 
conscious of at the moment which are having major 
systems implications. Probably the largest one will be 
the ECB reporting requirements under the single 
currency, but we do not yet know what the entire 
shape of those will be. 

(Mr Lewis) A small clarification as an example. 
The cross-border payments directive is currently 
being implemented. The effects of that are relatively 
small and I think it would be raising that to be too 
important an issue, but I think it is an example of the 
legislation that is currently going through which has 
been programmed in and which can be run in 
parallel, but clearly any additional legislation, I 
think, would be a major problem because both Mr 
Sweeney and I are members of the Chancellor’s 
Business Advisory Group and made this point I 
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think at the very first meeting that the simple 
technical clash between these two issues is a major 
problem and it has to be addressed full on. There are 
no political overtones to that statement whatever. 


512. There has been a recent report about a report 
to the White House from the Chairman of a 
computer software company, Capers Jones, which 
has advised that the combination of EMU and the 
millennium time bomb could be a _ financial 
catastrophe. Do you have any response to that? 

(Mr Sweeney) I think in terms of the United 
Kingdom our position is clear and we have explained 
it; we could not do the two together. 


513. Could not do the two together? 

(Mr Sweeney) We could not do the two together. 
Now the question of the rest of Europe is very 
difficult for us because we do not have information 
on precisely how Europe is tackling this problem. We 
are told by our sister associations and by banks that 
we have contacted in Europe that they are confident 
they can do the two things together. One reason they 
advance is that they had more planning time and a 
greater degree of political certainty, whatever the 
business uncertainty was, about EMU and that 
enabled them to be further ahead than we are. That 
may be so; I do not know the answer. 


Mr Beard 


514. Mr Sweeney has answered the question I was 
going to ask, but I would like to know to what extent 
are British banks’ IT systems interlinked with banks 
abroad and dependent on IT systems abroad? 

(Mr Sweeney) I think in terms of their core systems 
they are not. Their systems tend to be discrete. The 
nature of overlap is really in the international 
payment systems through the Swift mechanism and 
so forth and Mr Lewis, you may care to respond to 
that. 


Chairman 


515. Mr Lewis? 

(Mr Lewis) I think, Chairman, it is really a matter 
more of the business flows rather than the 
interlinking of systems as such. Clearly, for example, 
foreign exchange settlement would be a major 
problem if there were to be a significant systems 
failure on the part of one of our major FX 
counterparts or indeed if the Swift system, which 
carries most of the messaging, were to suffer 
significant degradation. It is for that reason that we 
have been paying particularly close attention to the 
preparations that Swift have been making, but again 
for them this is not a life enhancing exercise; they 
have got to get it right and we have been in a fairly 
vigorous debate with them about the terms in which 
they are operating. But I think in terms of direct 
connection, as Mr Sweeney said, I think there are 
very few direct traffic connections in that way at all. 
It is a question of the business flows. 

(Mr Sweeney) Mr Chairman, perhaps I could just 
add something because the international dimension 
is one that worries us a lot, because we do not have a 
clear feel for it. We cannot have. There is a 
competitive element, as I have already described, to 
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some extent within the United Kingdom. We have 
overcome that; we have not overcome the 
competitive element in other international centres, 
We have done a number of things. One is that we are 
members of the European Banking Federation and 
we have persuaded them to run a survey amongst 
other member countries to see what other 
information we can gather. We are also setting up a 
working party of banks based in the United 
Kingdom, which includes our foreign bank 
members, trying to identify what we think as an 
industry, the collective international rate of progress 
is. Third, we are members of a group with the 
American Securities Association and 12 global banks 
which is having its first meeting next week where 
again we will be sitting down to see what information 
we can share and what pressure we can put on other 
centres. Finally, we have suggested through Action 
2000 that embassies should be encouraged to ask 
questions within their centres and feed information 
back. It may be that there are no problems, but there 
is a dearth of information about what is actually 
happening overseas. 

(Mr Young) Mr Chairman, may I just add a gloss 
to that? 


Chairman 


516. Mr Young, yes. 

(Mr Young) Thank you. We have a concept of 
information black holes and these are the things that 
worry us and what is happening overseas and in 
certain parts of the world is an information black 
hole. Our concern is that unless these black holes are 
filled with information, business decisions are now 
being made and will increasingly be made by banks 
and by businesses in the United Kingdom in 
ignorance and the danger is that these decisions will 
be poor decisions and that is why as a group of banks 
we are coming together to try and identify the 
international hot spots so that if we can pool that 
information amongst banks—are we all worried 
about this country or that country—that at least 
gives us a better target to aim at. It it allows the banks 
themselves in their own systems in dealing with 
correspondent banks to identify which countries and 
banks they need to act on first of all. 


Mr Beard 


517. To what extent are we in danger of importing 
century date change problems into our own banking 
system through these connections? 

(Mr Sweeney) Very limited. As Mr Lewis said, it is 
a question of business flows. There is little or no 
interlinking of systems. They tend to be discrete. 
That is one of the reasons why, as I said earlier, there 
will be outlyers in our own survey. In the main they 
will be foreign banks and the reason simply is that 
their head offices are concentrating on the domestic 
head office system and the United Kingdom branch 
is at the bottom of the pile for timing. There is no 
interlink. 
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Chairman 


518. Mr Lewis, would you just like to convert your 
nod into an affirmation so that it goes on the record? 

(Mr Lewis) Yes, indeed. I was just going to say, 
Chairman, if I might just pick that point up, I think 
one of the problems has been that often people fear 
that others are not making preparations, but when 
they ask the questions they discover in fact that there 
is quite a lot of work being done, but people do not 
often articulate that as well as one might wish. I think 
Dr Jones referred earlier on to access to a website. 
The BIS has now created a website for payment 
systems for precisely this reason. There is now a very 
good site that actually demonstrates the extent of 
compliance of other major international systems 
which I think has provided us with a great deal of 
reassurance. 

Chairman: Thank you very much. 


Dr Jones 


519. What is it called? 

(Mr Lewis) It is the Bank for International 
Settlements at Basle. Perhaps, Chairman, I could let 
the Committee have a note of it. 


Chairman 


520. Could you let us have a note? 
(Mr Lewis) It is clear, tabular and in non- 
jargonistic form. It gives you a very good— 


521. Just like your comment! 

(Mr Lewis) Could I just make one other point 
about the corruption of data? I know that a number 
of the Members of the Committee are much more 
expert in this field. I think they have direct IT 
experience which I do not, but I think the problem 
sometimes is that a filter can prevent corrupt data 
coming into a system, but what it does not dois allow 
business to flow and again we focus back again on the 
fact that it is customers’ business which is therefore 
being impeded. I think there is much less risk of 
corruption of data as such rather than that people’s 
business will not get done. 

Chairman: Right. We still have quite a long way to 
go, so Mr Williams? 


Dr Williams 


522. Your comments internationally over the last 
few minutes indicate that in the future you will be 
looking at this or there will be meetings about this 
and that. In your experience so far are there some 
countries that have got their acts together quite well 
and where we can perhaps learn from their good 
practice? 

(Mr Sweeney) There is plenty of anecdotal 
evidence, the trouble is that much of it is conflicting 
and we do not have the means ourselves to test or 
check. Anecdotally the Americans are well seized of 
it, we are in the middle and the Europeans are not. It 
is very difficult for us to go beyond that. 


523. Is there any kind of international forum where 
perhaps the European Union in its summits, since we 
are President this six months, for G7 or IMF—are 


you participating in any kind of discussions in those 
kind of forums to try and co-ordinate internationally 
to the business community? 

(Mr Sweeney) There is a conference at the BIS later 
this month which we would be attending in common 
with a number of others. Otherwise we are co- 
operating whenever and wherever we can with 
whoever we can. The difficulty as I said before, in the 
domestic context, but it is in spades within the 
international context, is that there is nobody who can 
say: “This is our prime responsibility and we will pull 
it all together”. This is why it is quite difficult to 
answer the question about what countries are doing 
well. 


524. So as far as you are concerned, Britain seems 
to be all right but we do not know very much about 
other countries? 

(Mr Sweeney) I would have to say that that is the 
state of our information, which is why we are 
concentrating on things like our information 
exchange through the European Community. One 
thing, which may or may not be an indicator, I was 
recently making one of my regular trips to Europe, 
speaking to a number of European Parliamentarians 
and I was questioned, I would think, by three who 
said, as if they had just discovered it, “Is the Year 
2000 a real problem?” and my instinct is that Europe 
has not yet taken this as seriously as it should, but I 
cannot put my hand on my heart and give you 
evidence; that is my instinct. 

Chairman: A quick question from Dr Jones and 
then Dr Gibson. 


Dr Jones 


525. Could I just take you back to what I thought 
was a very important point you made that the United 
Kingdom banks could not possibly deal with the 
EMU and the millennium compliance at the same 
time and you speculated on the reason why European 
banks may be able to cope? You said they are further 
ahead on EMU. How could we find out and if they 
are not, what are the implications for us? 

(Mr Sweeney) How we can find out? I honestly do 
not know the answer to that. The difficulty is that 
there is a competitive element in this. If you go and 
look someone in the eye and say: “Is your business 
going to be still functioning on | January in the year 
2000” they will say: “Yes”. What else could they say? 
They will not give you guarantees and statements of 
compliance, but they will say yes and all European 
bankers that I speak to say: “Yes, do not worry. We 
have it under control. We know what we are doing”. 
There is no international mechanism for testing that. 


526. Should the Government in its role as 
President of the Union be doing something to find 
this out? 

(Mr Sweeney) | think that the more information 
exchange there is the better. It is quite difficult to 
know how one goes beyond information exchange. 
The more raising of the profile of the problem the 
better. One of the reasons why I mentioned my 
contact with European Parliamentarians; the more 
that there are people in Europe who are putting 
pressure on to say, well, it is a problem and we need 
information, we need some evidence that you are 
addressing the problem, the better. 
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527. You mentioned that you are doing a survey to 
look at millennium compliance. Could you not do a 
survey to look at EMU at the same time? 

(Mr Sweeney) That is only within our own 
domestic market. This is a European Banking 
Federation Survey— 


528. Yes, that is what I meant? 
(Mr Sweeney)—that is on the Year 2000. 


529. But could they not do a survey on the EMU 
preparedness? 
(Mr Sweeney) On EMU preparations? 


530. Yes. 

(Mr Sweeney) I think if you asked the Federation, 
the Federation focus has been on nothing but EMU 
for practically the last two or three years. They are 
quite confident that they will be ready. 

Dr Jones: So they should— 

Chairman: I think we should leave EMU, if you do 
not mind. 


Dr Jones 


531. But they should have the information? 

(Mr Sweeney) They will have the same expressions 
of comfort that we have. 
Chairman: We will leave EMU compliance I think 

for the moment and we will stay on 2000 compliance. 
Mr Beard? 


Mr Beard 


532. Forgive me Mr Sweeney, but is it not likely 
that if they are transferring their systems for EMU, 
they are putting the date change problem right at the 
same time and there is no real conflict? 

(Mr Sweeney) That is what they say. 


Dr Gibson 


533. Are you also saying you cannot test the cross 
border transfer of international payments before the 
millennium there is so much lack of information? 
You are saying that, are you not? You cannot do a 
little test and find out? 

(Mr Lewis) Chairman, would you like me perhaps 
to pick that up? 


Chairman 


534. Yes, please. 

(Mr Lewis) One of the points that we addressed 
quite early on I think and one of our principal 
concerns was the possibility of doing end to end 
testing. The answer is that banks are indeed using 
their own mechanisms and Swift and selected 
partners, particularly their key commercial partners, 
to try and run those sort of tests. What we found very 
quickly though is to generate truly representative 
overall end to end tests is really very complex and the 
problem is also that they would have to run on live 
systems that itself brings in both project risk and 
technical risk. The answer is we are still looking I 
think for ways in which we can reassure ourselves 
that at least key partners’ systems will work and will 
interact. One of the problems for example is that they 
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run over Telecom networks and one can only be 
absolutely sure those Telecom networks are 
compliant on | January 2000. 


Dr Gibson 


535. Tell me, do you have contingency plans and 
tell me about the disaster that might ensue? 

(Mr Sweeney) The answer on contingency plans is 
that it is genuinely too early. The focus at the 
moment is on getting things right. We have begun the 
process of thinking about contingencies and a 
working party has been set up and its first meeting 
will be next week. 


536. Have you a date in mind when they ought to 
report back to you so you can make such a decision? 
Is there a date? 

(Mr Young) Chairman, if I may pick this one up. 


Chairman 


537. Yes, of course. 

(Mr Young) The plan is to do some initial work and 
then for all the banks to hold a brainstorm in May 
where we can hopefully look at all the risks and assess 
and prioritise the risks to banks in London from all 
their operations, domestic and international. Then it 
will be a question of identifying the extent to which 
you can develop contingency plans for the sort of 
things that are likely to go wrong, or the extent to 
which for certain things there is not a chance of 
having any sort of contingency plan. What you have 
to do is test the thing to death and make sure that it 
absolutely works without any chance of failure. 


Dr Gibson 


538. So the possibility still remains then that there 
could be a disaster in terms of the international 
monetary payments system in the Year 2000 that 
night or for some period? That is still a strong 
possibility? 

(Mr Sweeney) I would remove the word strong. 
There remains a possibility. It is not going to be 
possible for anybody to put their hand on their heart 
until the system actually works in a live way. But— 
and I cannot emphasise this enough—the amount of 
effort that the industry is putting into this because it 
is sO aware of what the consequences are that I 
genuinely believe that the probability of disaster, 
certainly within our domestic system, and within our 
major partner systems is negligible, but I cannot say 
that it is out of the question. 


Mrs Curtis-Thomas 


539. You made reference earlier on to some SMEs. 
How critical is the Year 2000 to small and medium 
sized businesses? 

(Mr Sweeney) We believe you can segment the 
world broadly into three. The big corporates who are 
the same sort of size as the banking industry have 
addressed this, have the resources and can largely be 
stacked in the same way as the banks can. The very 
small people can also be stacked, largely because they 
run on small PCs and if the worst comes to the worst, 
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[Mrs Curtis-Thomas Cont] 

you can chuck it out and go to Dixons and buy 
another one. The big problem is with the small and 
medium sized enterprises, people who have small 
systems—half a dozen terminals, 50 to 100 plus 
people—often will have custom built services made 
by small local software houses that have gone out of 
business. They do not have the resources; all their 
energy is diverted to day to day business so they do 
not have the resources to divert this problem. That 
not have the money to buy in the expertise even if 
they could find it. That is where the problem is and I 
think everybody is agreed on that. We in the banking 
sector have made one of our priorities getting 
information into the hands of these people, so all the 
banks almost without exception have produced very 
sizeable little tomes, some of which I think we sent 
the Committee, which are there as guidance. We have 
produced ourselves a more modest leaflet for banks 
who do not want to produce their own which goes 
out to customers to help them identify the problems 
and to set out planning how to address them. You are 
absolutely right. That is the core problem and we 
believe that much of that sector is well behind the 
pace at the moment to resolving the problem in time. 


540. Do you think Government has a role to play 
here with respect to that particular sector of the 
market? 

(Mr Sweeney) I think Government certainly has a 
role in providing information in the same way that 
we do. What role it has beyond that is quite difficult 
to see. At the end of the day these are small 
companies that have to find the resources to do the 
work. No-one can do it for them. 


541. Could I suggest then would you support tax 
exemptions for firms below a certain size or in fact 
that fall within this critical group where they really 
are too busy engaged at the coal face to consider 
these systems? So, would you support tax exemptions 
for those firms in respect of their expenditure for 
compliance procedures? 

(Mr Sweeney) We have not given any thought as 
an Association to tax matters or incentives of that 
nature. I think I would say that anything the 
Government could do to help that sector the better 
and if the Government wanted to offer tax incentives 
I would be fully supportive, but it is not really an area 
to which I have given a great deal of thought, I would 
have to say. 

(Mr Young) Chairman, may I add a gloss on that? 


Chairman 


542. Yes, Mr Young? 

(Mr Young) | think for the Government to really 
help medium sized businesses which face this great 
challenge it needs to make that help in a form that 
will really be beneficial to businesses. As Mr Sweeney 
said, tax exemptions and things like that are not 
things that we would particularly have an opinion 
on. | am not quite sure in my own mind, if I may 
express a personal opinion, that that would be the 
best way of giving the help. I think that it may focus 
people’s attention; there may be other ways of doing 
it. | think what businesses need, the surveys that the 
banks have done, show that there is quite a high 
degree of awareness of the problem, but insufficient 


action and I think it is: “Where do I go to get help?” 
that businesses particularly need. That is where we 
are hopeful, and we have the problem with bank 
managers around the country being asked by 
businesses: “So okay, I have read your booklet. Now 
what do I do?”. Now the average bank manager in 
Aylesbury is not an expert on solving these kind of 
systems, but he needs to know a man who does. He 
needs to be able to signpost and that is where we are 
hopeful that the sort of material that Action 2000 and 
Business Links are putting out will help us to 
signpost businesses to good quality—and that is a big 
question—help and advice. 


Mrs Curtis-Thomas 


543. So the Business Links and TECs have a role 
to play, you believe. 
(Mr Young) Yes, a very important role. 


Dr Jones 


544. What progress has been made in setting up the 
skills pool that you say Action 2000 were looking at? 
Again there is no mention on their millennium bug 
website. 

(Mr Young) Chairman, I am afraid that is not an 
area that we have been involved in with Action 2000. 


545. You just said you welcomed it? 

(Mr Young) We are aware that some work has been 
done by them, but I have to confess that we are not 
up to speed on that. Our work is concentrated on the 
advice and best practice element. 


546. If some of your members had got rather large 
loans to some of these companies, to what extent 
would they try to find out whether they were 
millennium compliant and use their influence 
because presumably they could, at the end of the day, 
call in loans if they felt business was going to fail? Is 
any work of that nature being undertaken? Another 
point is that you have called for non-compliant 
systems now to be declared unfit for their purpose 
under the law. Does any action need to be taken by 
the Government to move along in that direction? 

(Mr Young) | know that banks lending to medium 
sized businesses are all training and guiding their 
managers to help them assess the Year 2000 
vulnerability of the businesses that they are dealing 
with. A lot of banks have tackled this by doing 
samples of their loan portfolio trying to identify the 
characteristics of businesses that are vulnerable and 
then trying to generalise that and apply that to the 
whole loan book so that managers have a target to 
aim at, because there are 3.8 million enterprises in 
this country. If you went to talk to all of them you 
would never get it done by the year 2000. So they are 
trying to prioritise and identify the ones that are most 
vulnerable and those are the ones that they want to 
go to and particularly help them to get the help. It is 
not something that we can provide, but we have a real 
interest in making sure that they are aware of where 
the help is and that they are taking it. I think we are 
a long way away from the loans being called in yet, 
but that ultimately will be something that would have 
to happen. In terms of unfit systems, there may be 
scope for Government action there. I am aware that 
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some of the major retailers are putting stickers on 
their machines “Millennium Ready”. I think that is 
an advance. I think that the smaller and medium 
sized businesses who face the greatest challenge are 
the ones who need the help in making sure that if they 
do go to Dixons and buy a new machine they are not 
buying another lot of trouble. 

Chairman: Mr Young, thank you very much. We 
are now coming to our final question because time is 
up and I would like to invite Mr Atkinson to put it 
to you. 


Mr Atkinson 


547. In fact you have already answered the 
question I proposed to put about contingency 
planning, so may I just pick up the theme of your last 
answer, Mr Young? In hindsight, and perhaps even 
still now, would it not have been helpful if there had 
been legislation which required companies to use the 
annual report to report back to their shareholders the 
millennium compliancy of their computer systems 
or, if not, the action they were proposing to take? 
That would have a ready checklist which would be 
available not only to the shareholders, the owners of 
the companies, but to yourselves, the bankers of 
those companies to know precisely where you are at 
regarding those companies? 

(Mr Young) I think that may have been helpful, but 
I think the more important thing is to engage in the 
dialogue with businesses. The amount of information 
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that you could include in an annual report would be 
limited and there is the danger that it may raise more 
questions than it answers. But we have here this 
afternoon constantly plugged the need for 
information flows and information exchange and I 
am not going to argue against anything that 
generates more information. 


Chairman 


548. Mr Young, I am going to stop you there 
because you do not know it but you have given the 
wisdom of Solomon in that answer. Mr Atkinson has 
been advocating for the last 18 months for legislation 
and you gave an answer that Solomon would have 
been proud of and I think while you are winning we 
will stop! 

(Mr Young) Thank you, Chairman. 


549. May I thank all three of you, Mr Sweeney, 
you and your two colleagues for coming along this 
afternoon and helping us with our inquiry. There 
may be just one or two points we have not had the 
time to cover. If that is the case, would you be 
prepared to answer one or two written questions 
for us? 

(Mr Sweeney) Of course. 

Chairman: Thank you very much indeed for 
coming, for your frank, helpful and skilful answers. 
Thank you very much. 
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APPENDIX 1 


Letter to the Clerk of the Committee from Dr C N M Pounder, Editor, Data Protection News 


We are specialist consultants working in the field of data protection, and editors of Data Protection News, 
which is published by Cap Gemini UK ple. You will recall, during our telephone discussion earlier this week, 
that we agreed to send the Committee our analysis concerning Year 2000, the Data Protection Act1984, and 
the forthcoming legislation to implement the Data Protection Directive (95/46/EC) as announced in the 
Queen’s Speech. 


In summary, we believe that the impact of the Year 2000 from the data protection perspective has been 
very much underplayed, yet all systems which process personal data (eg most major systems of central and 
local government) are and will continue to be subject to data protection legislation. Consequently, we do not 
believe that any further legislation is needed to protect Data Subjects; Data Users, if they are to process 
personal data lawfully, must establish mechanisms with respect to data protection compliance and this should 
include Y2000 compliance. However, we do recognise that further legislation might be needed with respect 
to those systems which do not process personal data. 


_ Can we take the opportunity to raise two points with the Committee: 


(a) firstly, since many organisations must register under the Data Protection Act 1984, then the Office 
of the Data Protection Registrar could be well placed to co-ordinate any urgent advice or research. 


(b) secondly, the new Data Protection Bill could offer a suitable legislative hook to which to attach any 
urgent recommendation from the Committee; such a route could also be appropriate, where a 
mechanism for official enforcement action is seen, by the Committee, as being necessary. For 
instance, much of the intention of the Companies (Millennium Computer Compliance) Bill, as 
published in the previous session of Parliament, could be achieved by ensuring that the notification 
requirement with respect to the security of processing (Article 19(f) of Directive 95/46/EC) was 
modified: 


— toincludea particular reference to measures taken by an organisation with respect to Year 2000 
compliance; and 


— to place any such reference in the public domain. 
4 September 1997 


APPENDIX 2 


Letter to the Clerk of the Committee from Mrs Judith Scott, Chief Executive, The British Computer Society 


I am writing to you about the planned investigation to be undertaken by the Select Committee, which I 
understand is concerned with problems in IT arising from the Millennium Bug. 


As the Chartered Professional Institution in the field of Information Systems and a member of the 
Engineering Council, the Society is delighted that the Committee is undertaking a review in the field of 
information technology and information systems. We are very strongly of the view that this is an important 
field of public policy which has not attracted the level of considered debate which is desirable. 


The Millennium bug has served to highlight some underlying and important public policy issues, but the 
Society is concerned that in pursuing the focused debate on resolving the impact of the Millennium bug, the 
government will loose sight of these fundamental issues in the belief that the Millennium bug solutions are 
in themselves the answer to everything. Of course it is important that the Millennium bug is addressed, and 
the Society is contributing to this through the publication of good practice guidance. 


- The fundamental public policy issues that are being highlighted are: 


— the massive reliance of many sectors of the economy on IT systems, and the risk that poorly 
engineered systems could bring sophisticated western democracies to the brink of collapse; 


— the opportunity to use IT as an agent for business development and the management of the related 
risks are still relatively invisible in the boardrooms of the nation, often leaving IT and Information 
Systems shrouded in mystique; and 


— the lack of a widely accepted professional framework of competence in the design and 
commissioning of IT systems, allowing work to be undertaken by all and sundry including the 
incompetent and dishonest. 
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We would urge the Select Committee to consider these issues as part of its review of the Millennium Bug, 
because it is only by addressing them that we will avoid another “millennium bug” in the future. We have 
attached as background material a paper which is part of the Society’s review on requirements for regulating 
the professional practice in Information Systems. 


9 October 1997 


Annex 
PROFESSIONALISM IN IT 
REVISED DRAFT, 9 SEPTEMBER 1997 


INTRODUCTION 


The central issue seems to be that IT has developed over the last 50 years as an unregulated industry and 
not as a profession, with all the possible consequential problems. 


Characteristics of a profession are: 


members are individuals with individual responsibility for their work, there is an independent 
regulatory body to maintain practitioner standards, services normally charged by fixed fees or T&M 
and not by result, use of best endeavours at all times to represent the client interest. 


(Ref Lord Benson on the definition of a profession) 


Analogies with building and civil engineering suggest that other fields have differentiated into the 
professionals representing the non-expert client, eg the architect or consulting engineer, and a large and 
diverse industry of contractors providing a range of contributing services and activities to undertakings and 
projects normally led by professionals. Professionals take personal responsibility and so often trade as 
individuals or partnerships. 


There are differencies in the approach to regulation in professions. Doctors have both a “union” to 
represent their interests in matters such as pay negotiations and a regulatory body responsible for 
maintenance of standards. Solicitors, on the other hand, have currently only one body to carry out both 
activities, and there is debate as to the efficacy of the single body approach. In the professional Engineering 
Institutions, I understand that only the Civils and the Structurals meet the Benson criteria in full, in that 
members can be disbarred from practice for incompetence. 


THE CURRENT SITUATION 


The current IT business is simply chaotic in structure. There are no effective professional or regulatory 
bodies. The general view is that IT people are unregulated pirates exploiting gullible clients and the courts 
often seem to take decisions in line with this perception. Conversely, well intentioned IT people struggle with 
clients who can’t or won’t describe what they want and then sue when they don’t get it. Professional 
qualifications exist, eg the FBCS and CEng, but the vast majority, ie some 90 per cent, of people in IT -have 
no specific qualifications and the CEng carries little or no real weight. There are no generally accepted 
definitions of competencies in IT. There are no sanctions which can be exercised to restrict the incompetent 
from practicing. 


Ways FORWARD 


Can anything be done? Some possibilities and issues are as follows. 


REGISTERS OF “LICENSED PRACTITIONERS” 


The suggestion has been made (Jon Vogler, BCS AGM 30 Oct 1996) thati the BCS should establish a 
“Register of Consultants” and a BCS working party is looking at the idea. A study is in process in the safety 
criteria area to define, inter alia, the requirements for competence to practice in the area. In the IT security 
and expert witness fields, registers are already functioning. And the issue is receiving attention in the 
accountancy field in which, as in IT, anybody can claim to be an “accountant”. 

There are three levels at which such a device could be pitched: 

(a) as a marketing device to publicise a list of practitioners; 
(b) as a statement of adherence to a code of practice; and 
(c) as a further qualification level: in effect a licence to practise in the speciality. 
In my view, (a) would be in conflict with the role of a professional society, as it seems to advertise the 


services of some members but not others. Furthermore, it does not address the issue of professionalising the 
industry as, at the level of a list of names, it has no real associated sanctions. As to (b), the BCS and other 
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professional societies already have codes of practice which would be helpful were there any means of 
enforcing them—currently they are honoured in the breach and not much in the observance. 


The introduction of a further level of licencing, as in (c), raises all the questions as to the means of gaining 
membership of the list—by exams, or by CV and interview and if so, who does the interviewing, what is the 
appeals mechanism, etc. However, this may be a constructive way forward as an intermediate step to possible 
later legislation. 


PI INSURANCE 


In many other professions where individuals take responsibility for their professional decisions it is usual 
for them to carry individual Professional Indemnity insurance or for their employers to carry corporate 
insurance which covers professional risks. It is expensive, likely to get more so and generally difficult to obtain 
unless you are licenced to practice. PI in the IT area is a developing market and it may be that we can influence 
the attitudes of underwriters to a relationship between certification and rates. There is evidence that some 
insurers require evidence of operation of a Professional Development Scheme within a Company before 
quoting for cover. 


GOVERNMENT PURCHASING 


Should Government purchasing contracts require professional standards? (ISO 9000 etc. look useful but 
really only address project admin techniques, ie they address the process but not product quality). So the real 
issue here would be to convince Government that serious contracts should contain requirements on levels of 
qualification of staff carrying out the work: e.g. 


— any project above £1 million headed and signed off by a CEng; and 
— any project above £5 million must have at least five per cent staff with CEng, etc. 


Note that an early example of this approach in the USA was the DoD Orange Book requirements for 
security projects back in the early 1980s—in those days it called for academic degrees whereas now we have 
engineering qualifications which are perhaps more relevant. 


There is a difficulty here in that Government is not what it was 20 years ago—now we have a plethora of 
distributed privatised utilities, quangos, local authorities and ministries. The only central body with some 
overarching authority for larger sums is the Treasury. It may be that a useful body to approach for advice 
and for discussion as to the way ahead is the Audit Commission. 


EVIDENCE 


Our claim is that in essence, properly trained and qualified engineers will produce better quality IT 
systems—it would be good to be able to support this claim with evidence. Is there any actuarial data, for 
example in the insurance world? Legal cases tend not to provide useful data for this purpose as they often 
turn on contractual details and points of evidence which are emphasised by counsel in their endeavours to 
win for their clients, and not on overall system quality issues. 


LEGISLATION 


The purpose of legislation in the commercial world is generally to set ground rules for the operation of the 
free market, but there are areas of public concern where there is direct legislation. The system of licencing 
aero contractors and individuals is well established and effective and driven by the clear and direct risk to the 
public. In the case of IT systems, the risk is often great but to the client’s pocket rather than to his life, except 
in some safety critical areas. 


Should work in the safety critical applications area require use of qualified people, e.g. CEng? An SCS 
competency scheme is under consideration—tef discussion at the BCS SCS task force, 1 May 1996. The CEng 
would seem to be the only realistic basic qualification, together with licenced practitioner lists in specialist 
areas as discussed above; anything more specialised would have even less public visibility and acceptance. 


Security issues are closer in general to Government interests than other areas, and the licencing 
arrangements in this area for individuals and for Evaluation Facilities for secure software may suggest ways 
ahead in other areas. 


THE YEAR 2000 PROBLEM 


Increasingly this is becoming a public issue where IT people are seen to have failed to foresee the obvious 
and to take steps to safeguard systems against the millennium. This is causing vast expense and difficulty, 
both public and private. Can we use this issue to advance the cause of responsible certification? 
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CONCLUSION 


To reiterate—we need to use some or all of these routes to move forward to a responsible licencing and 
certification scheme for the profession, with the overall aim of increasing economic benefit for the country. 
We have only one accepted public qualification available to us: CEng. But this at present has no real weight 
and is largely ignored within the profession. 


I think that moving forward hinges on the power and credibility to enforce sanctions such as de-licencing 
a manifestly incompetent practitioner. This will not happen voluntarily and will need coercion, by some use 
of power such as Government purchasing weight or in the long run by legislation. If informed users such as 
Government set the pattern of requirements then others will follow. 


9 September 1997 
APPENDIX 3 


Letter to the Clerk of the Committee from Mr Mike Scanes, Managing Director, Bridgeway—Sicor Ltd 


It occurs to me your committee may be interested in our experiences in dealing with the Millennium over 
the last two years. 


I believe the fundamental problem is the manner in which the message has been carried. Invariably it has 
too much IT content, or journalese, and in both cases readers are unable to identify with the issues simply 
because they cannot relate it to their business. While there is an increasing amount of information available 
this in turn is too generic and not easily identifiable by business type. 


The solution we have adopted is to identify businesses by type or industry. From this it is possible to 
estimate the level of risk. Precision engineering has a greater risk than the paint industry for example. 


My particular concern is that there is so much Millennium mis-information it is difficult to determine that 
which is good and that which isn’t. Late last year there was a flurry of software arriving for checking PCs for 
compliance. Recently the computer press reported that most of it was ineffective. 


Similarly at a recent Millennium conference a Microsoft spokesperson told the audience all Microsoft 
products were Millennium compliant as they use four digit notation. Half an hour later a director of a 
software house completely demolished Microsoft’s claim with a demonstration of Windows95 using a lap top 
and overhead projection. It was both awesome and a frightening demonstration. We never heard from 
Microsoft again. 


In co-ordinating that which is available how do we truly know what is good and what is not? Or that which 
we provide today will not turn out to be useless tomorrow? 


With SMEs the big problem is that all businesses are different and require different perceptions and 
approaches. Because of the manner in which the message has been worded, most businesses think it is 
everybody else’s problem but theirs. Within half an hour of discussion the penny usually drops. 


It is the interpretation of the information and the quality of the advice which is given to SMEs, which is 
important. My experience so far is that once given the direction and a little sensible verbal advice most 
businesses are perfectly capable of handling the problem, although some may need a little early and 
ongoing support. 


When Millennium programmes are put into place it is usually the financial institutions which start first and 
are then followed by business and industrials. This has happened in the USA and is now following a similar 
pattern here. 


The recent report from the Gartner Group that European Banks are not addressing the millennium 
problem is deeply disturbing. While it is serious enough the banks are not sufficiently aware the knock-on 
effect will be positively catastrophic. This is because until the banks take the lead industry does not follow. 
This in turn means any British company importing finished goods or raw materials from Europe runs a severe 
risk of disruption of supply in the early months of 2000. This applies equally to exporters to Europe who may 
find customers cannot accept scheduled deliveries. 


Such judgements cannot be embodied within a standardised format, and each case will be horses for courses 
with recommendations made based on the latest information available. 


While I accept the majority of businesses will survive because they cannot afford not to, the potential for 
a period of disruption is very real, and we work to minimise this and ensure businesses survive intact even if 
it has to temporarily stop trading in January 2000 because of external influences. 


_ The requirement for a method of identifying the high risk companies is I believe fundamental because it is 
vital to direct support and resources to those most at risk. The blanket approach could mean support is 
offered to companies who need it the least, while those who need it the most get little or nothing. 


Our approach is to carry out a corporate Millenium Impact Analysis with recommendations for action. A 
follow-up visit is arranged to access the results of the companies efforts. Some have achieved 70 per cent 
compliance within a few weeks of a single telephone call. Surprisingly this has been achieved at nominal cost 
and experience to date indicates the actual cost is nothing like that which is claimed in the press. 
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For large main frame computers which may not be compliant in time, we have identified a patented 
methodology in the USA which can bring a system to full compliance within months. It is possible to state 
as late as June 1999 and still complete in time. On the skills issue there are others who can provide a significant 
input who are not necessarily IT professionals. 


My personal view is that addressed correctly the Millennium problem need not be the disaster it could be, 
and given the right approach can be easily resolved. 


20 November 1997 
APPENDIX 4 
Memorandum submitted by Xi Software Ltd 


INTRODUCTION AND SUMMARY 


The Company has worked for nearly 12 years in programming computers. The software produced by the 
company includes heavy dependency on dates and the sorting and selection of data by dates. We believe that 
we have extensive experience in this area. 


It is the belief of the company that the much-publicised “Millennium Bug” is grossly exaggerated both in 
its extent and purported consequences. We are gravely concerned that the allocation of extensive funds to the 
investigation of this problem would be a waste of public resources and would divert much-needed funds from 
more serious problems both inside and outside the computer industry. 


THE WAY DATES ARE HELD ON COMPUTER 


All modern computers, including PCs produced in the last few years and associated software, now hold 
dates and times as the number of seconds since midnight on 1 January 1970. This is held as a 32-bit binary 
signed integer, which can hold from 0 to 2,147,483,647 seconds. To compare two dates, the larger number 
represents the later date and time. 


At midnight on 1 January 2000, the date and time held in this way will change from 946,684,799 to 
946,684,800. This is not regarded as particularly significant. 


Accordingly, we cannot accept that anything spectacular will happen at midnight on 1 January 2000. 


Why IS THERE ANY PROBLEM AT ALL? 


The only source of any problems is where the dates held in this format are converted to or from human- 
readable format. 


In order to display dates, the date and time held as described above has to be broken down into a standard 
format. To find the day since 1 January 1970 divide the current time by the number of seconds in a day 
(86,400) and discard the remainder. To extract the day, month and year from this is a little more complicated 
but not that much more. 


However, all modern computers have a routine to do this “built-in”, to produce a sequence of numbers as 
a “broken-down” date representing the year, month, day, hour, minute and second from the given input. 
Again there is little problem; here both 99 and 100 will fit into six bits, and most computers allow 32 bits for 
each field—as much as for the date and time being broken down. 


All that remains is to generate a string of characters from the “broken down” date for printing. It is possible 
that a carelessly written programme, expecting the year field to be at most 99, might display the date as 
“01/01/100” or something like “01/01/-0” but that is all. There should be no catastrophe. 


In order for a programme to read dates, the opposite operation has to be performed. Again it is possible 
that a carelessly written programme might misread a date after 2000 in some way. Clearly a year less than 70 
should just have 100 added to it to convert to the broken-down time. For most programmers that is almost 
a “knee-jerk response” by now. 


Whuy No PAnic? 


As we have tried to explain, the only problems might relate to the input of and the display of dates after 
2000, not to how the computer handles them. 


Most software which involves dates can be tested by just seeing if it will accept, and then correctly display, 
dates after 01/01/2000, which can be done at leisure before or after that date. 


The actual processing and sorting of dates will be done using the internal “seconds after midnight on 
01/01/70” format for which the year 2000 is insignificant. 
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CONCLUSION 


We believe that the stories of “aircraft falling from the sky” and “life-support machines failing” do not have 
even a grain of truth in them. We believe that the only problems relate to the display and entry of dates which 
are irrelevant to these processes. We believe that most, if not all, software which fails to handle these dates 
correctly will make its faults apparent well before then, and we further believe that all modern software does 
correctly handle such dates. 


We would strongly recommend that no extensive public money be devoted to this problem beyond 
recommending that people be advised to ensure that any software they purchase correctly accepts all 
reasonable input dates and is able to display them correctly. 


20 November 1997 


APPENDIX 5 
Memorandum submitted by Mr Tim Johnson, Look Multimedia Ltd 


INTRODUCTION 


1. Look Multimedia is a specialist producer and distributor of video and multimedia programming for the 
computer industry. As its owner and managing director, I have been working on the Year 2000 computer 
compliance issue since 1995 and the company is now successfully selling two videos about the awareness of 
the Year 2000 problem and the legal issues it raises. Iam also a member of the BCS Year 2000 Working Group 
and will be contributing separately to their submission. 


SUMMARY 


2. My comments focus on point (111) of the Committee’s Terms of Reference and the related questions 
about awareness of the problem and the constraints on dealing with it. My view is that simple awareness is 
now quite high in the UK! and the key task now is turning awareness into action. For government, this means 
taking a more imaginative approach to help and encourage organisations to solve the problems. In particular 
I suggest the government should urgently consider setting up a Certification Scheme for Year 2000 software 
and systems compliance. 


3. One reason why people find it so difficult to tackle the Year 2000 problem on a psychological level is 
that—at least until systems start to break down—there is no positive incentive to deal with the problem now. 
It’s rather like trying to persuade a teenager to clear up their room. Vague threats of dire consequences are 
less effective than the promise of a positive reward. That does not mean that the dire consequences of the Year 
2000 failures should be ignored, but I suggest that government needs to find short-term incentives for solving 
Year 2000 problems as well as using long-term threats. 


LEGAL SANCTIONS 


4. Earlier this year I floated the idea of legislation to limit companies’ liability to legal action over Year 
2000 failures if they could demonstrate that they had followed best practice on the issue. This would have 
provided an incentive to action, but after discussing the idea with various experts in the area, including several 
MPs, lawyers and the BCS Working Group, I came to the conclusion that legislation was unlikely to be a 
realistic option. 


5. In fact, there is already a formidable range of legal sanctions—from company law to health and safety 
to investor protection and beyond—which may eventually be invoked against companies which fail to sort 
out their Year 2000 problems. The weakness is that these sanctions will only apply after the failure has taken 
place. Government could do a lot more to raise awareness of the legal sanctions and the prospect that they 
will be enforced. I believe this would have some effect, but it comes in the category “warning of dire 
consequences” rather than “positive encouragement”. 


CERTIFICATION SCHEME 


6. Positive encouragement is likely to be more successful than vague threats and one way of providing it 
would be to set up a government-backed Year 2000 compliance certification scheme. Organisations would 
be able to submit computer software and systems for inspection under this scheme and, if they passed the 
tests, receive a certificate of Year 2000 compliance for them. 


__ 7. One attraction of this approach is that it would offer organisations which get the certificate an immediate 
identifiable benefit. They would have the best possible answer to business partners enquiring if they were Year 
+ -—__— 
' Awareness does not mean understanding. A friend who works as a volunteer for the Citizen’s Advice Bureau suggested to one 


client that she should acquire computer skills as a way of getting a job. The woman replied she wasn’t going to have anything 
to do with computers because people said they were all going to stop working in the Year 2000. 
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2000 compliant. If the certified software was for sale, it would sell better. If the systems concerned were 
internal the company would be able to show it was a better business partner with more secure future 
prospects. Certification should increase the value of a company and its share price. 


8. On the other hand, setting up a certification scheme will undoubtedly be difficult. Although there is 
certainly a demand for it, no private organisation has been willing to tackle the problems. Only government 
has the power and the motivation to carry out such a project. It seems to me something which the British 
government should consider seriously, as a matter of urgency. 


DECLARATION OF INTEREST 


9. As mentioned above, Look Multimedia is selling videos on the Year 2000 issue. I am also working with 
Ovum, the IT research and consulting company, to propose possible projects to Action 2000, including a 
feasibility study for a Year 2000 Certification Scheme. 


24 November 1997 


APPENDIX 6 


Letter to the Clerk of the Committee from Mr James Marland, Mr Michael Pillow, 
and Mr Peter Matthews, Directors, Savills ple 


MILLENNIUM TIMEBOMB AND THE PROPERTY SECTOR 


We write further to the Science & Technology Committee Press Notice No 4 of Session 1997-98, 30 October 
1997—The Year 2000 and Computer Compliance. 


We would like to draw your attention to the fact that many buildings face the same threat from the 
Millennium Time Bomb as computers and that, in our opinion, this threat has not been adequately addressed. 


THE PROBLEM 


The problem emanates from the numerous service installations that regulate the operation of buildings and 
the environment. These rely on controls which have embedded chips or microprocessors (similar to those 
found in computers) located throughout the building. When the millennium changes, the chip may not 
recognise the new date and so cease to operate as designed and in some instances not function at all. 


The worst case scenario could see loss in function of access equipment, security installations, fire alarms, 
air-conditioning and heating systems, lifts, escalators and back-up systems such as generators. 


THE SCALE 


Buildings most at risk are believed to be those constructed or refurbished in the 20 years up to the early 
1990s. These include shopping centres, offices, factories and public buildings such as libraries and hospitals, 
as well as conference centres, theatres, art galleries and museums. 


As an indication, Savills Research estimates that in the City of London, some 29 million square feet of 
offices was developed or refurbished in the 1980s alone. 


THE Cost 


Although the manufacturing cost of a chip is relatively small, estimated between £0.18 and £1.25 per chip, 
the replacement costs to British business lies between £2 and £3 per square foot—as it is not the chip 
replacement but the locating, testing and removal of the defunct chip which increases costs. 


However, although the actual cost for any particular building is not clear, what 1s, is that the costs of any 
business disruption will be greater. 


ASSOCIATED PROBLEMS 


Insurance—the Association of British Insurers has already stated that businesses will not be covered if 
systems, such as fire-alarms, fail in the Year 2000; because “there is reasonable time” to ensure that the 
systems will function correctly by the millennium. 


Mark Boleat, Director General of the ABI, has warned: “Insurers cannot meet the consequences of 
companies not modifying their systems to take account of the known consequences of a known event. 
However, they may be prepared to offer some cover against Millennium-related risks, but this will depend 
on policyholders having taken action to make sure their business systems, as well as those of their suppliers 


3°99 


and customers are “Millennium-compliant’. 
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CONCLUSION 


In the circumstances, if a great deal of inconvenience and significant financial loss is to be avoided, we 
believe the public should be made aware of the importance of this issue in sufficient time to allow preventative 
action to be undertaken. 


Savills has already initiated a planned series of investigations, checks and tests, first to identify where 
problems may arise and then to eliminate them. Buildings within the firms’s management control are already 
being checked to ensure they have Millennium Compliance. 


A team of property and IT experts is being brought together by Savills to provide the best advice available 
for clients. 


We will be pleased to assist the Committee in any way we can. 


17 November 1997 


APPENDIX 7 
Memorandum submitted by the Institute of Directors 


INTRODUCTION 


1. The Institute of Directors represents the interests of some 41,000 members in the UK to key policy 
makers, in order to achieve an environment in which business can thrive and enterprise will be rewarded. 


2. The implications of failure to cope with the Year 2000 problems are widespread and potentially very 
serious indeed. Hence our concern that maximum publicity be given to the problem and that the efforts of 
those bodies who are best able to advise be supported and centrally co-ordinated. 


RESPONSES TO PARTICULAR QUESTIONS POSED 


What is your estimate of the seriousness of the millennium bug problem? 


3. The problem is vast, extending well beyond IT departments. Any area where automated technology is 
used will be at risk. In addition companies will be exposed to any consequential disruption or non 
performance of their supply chain. Virtually no company will be immune as every PC currently in use will 
need checking and possibly rectifying and all software utilised needs to be assessed and critical problems 
dealt with. 


4. Aside from their own businesses our members will need to be assured that public safety is preserved and 
the basic communications infrastructure is maintained. This of course is a global issue and not restricted to 
the UK. 


To what extent do you think that UK businesses and other organisations have done, or will have done, enough 
to avert any potential problems? 


5. We have not seen any accurate recent data to be able to give an answer. We think a suitable form of 
measurement should be carried out as a matter of priority. It is not an area in which this Institute has any 
particular expertise and would, we suggest, be best co-ordinated by the DTI. 


6. However, circumstantially we believe that the vast majority of businessmen are aware of the issue but 
that only those with dedicated IT departments have actually done much about it. 


Do you think the Government has done enough to raise awareness of the problems associated with the date change 
or to encourage action to avert problems? What more should be done? 


7. No, it is felt that clear ministerial control should have been applied from the outset rather than relying 
on a minimally funded Taskforce 2000. The present creation of a new body Action 2000 is welcomed, 
although having two bodies operating may not lead to the co-ordination required. A top priority must be to 
set in place a mechanism for tracking progress as the millennium approaches so that appropriate changes in 
messages and resources can be implemented if required. An additional priority will be to provide directly, or 
co-ordinate elsewhere, help-points for sharing knowledge and sources of help. These help-points will need to 
distinguish clearly between the needs of IT professionals and those of non specialists. 


What, if any, are the major constraints militating against progress being made towards identifying and applying 
solutions to prevent computer system and software failures at the millennium? 


8. The constraints companies face are principally: 
— Budgetary constraints. 
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— Lack of suitable staff or contractors. 
— Inability to trace software suppliers. 
— Inability to identify location or nature of embedded chips. 


— Other, seemingly, more pressing business issues. 


28 November 1997 


APPENDIX 8 
Memorandum submitted by Electronic Data Systems Limited 


INTRODUCTION 


EDS is in a comparatively unusual position in that the very nature of our business is such that we are both 
a consumer of Information Technology (IT) products as well as being the provider of IT based Services. As 
such we have a broad view of the situation across commerce, industry, and the public sector. EDS is also the 
largest supplier of IT services to the UK market (Ref: “The Holway Report 1996”). 


For these reasons, in 1997, we seconded a senior member of staff to work with Taskforce 2000. This has 
given us an objective view of perceptions and progress as well as providing much-needed support to raise 
awareness of Year 2000 issues in the UK. 


We are pleased to present this memorandum as our response to the five Questions listed in your letter of 
3 November 1997. 


1. ESTIMATE OF THE SERIOUSNESS OF THE PROBLEM 


While the causes of Year 2000 problems are technical, the consequences of failure extend throughout the 
business, economic and social spheres. Furthermore, the Year 2000 issue is global in extent. EDS in the UK 
could be seriously affected by the failure of other countries to fix their problems. Individuals and 
organisations alike are at risk from the failure of infrastructure services (power, water, telecommunications, 
electronic funds transfer, etc) many of which are now subject to influence from beyond the UK. 


Some of the possible consequences of failure are: 


— Communications failure—businesses are now heavily dependent on international communications 
networks. 


— Unpredictable performance of equipment—major changes are detectable but minor changes may 
be almost imperceptible but will eventually become dangerous if cumulative. 


2. ACTIONS TAKEN 


EDS started to address the millennium issues several years ago. EDS has a large number of projects under 
way and some customers are already compliant. EDS has been strongly pro-active in persuading many 
customers to take the problem seriously and initiate work. We believe that we have identified everything that 
needs to be done, and are working on it. 


We are encouraging our customers to undertake stringent prioritisation of their business processes, and to 
address the most critical and complex aspects first. 


We are carrying out a rigorous internal risk management programme which includes: 
— Quarterly progress surveys. 
— Regular reports to board level in all units. 
— Schemes for staff retention. 
— Priority setting: 1—Customer work; 2—Internal compliance; 3—New Business. 


We do not underestimate the complexity of this issue. Despite our skills and planning, given the risks which 
we face from third parties it is still possible that we may encounter problems. Our approach is to fix everything 
known, manage the risk and plan for the unexpected. 


We are also engaged in what is currently one of the largest and most successful public sector Year 2000 
projects, for the Inland Revenue. We have restricted our observations in this reponse to those directly 
obtained from our own experience, which includes a broad spectrum of contacts beyond our own customer 
base and enables us to comment authoritatively both on policy and practice. 
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3. MAJOR CONSTRAINTS 


3.1 Year 2000 and EMU 


The need for parallel streams of work to prepare for the Year 2000 and the Single Currency adds to the 
complexity of the issues and the potential risk of failure. Even if the UK does not enter in the first wave, any 
UK company trading or reporting within the European Community must still be able to handle the Euro. 
The fact that other EC countries give the highest priority to work on EMU compounds the problem. 


Given the coincidence of the Year 2000 and the Single Currency, we believe that the government should 
recognise the very large amount of work that will be needed to tackle both requirements, and should weigh 
up the priorities carefully. 


3.2 IT Product Suppliers 


Many hardware and software suppliers are still perceived to be behaving unhelpfully. There is a lack of 
easily available, easily intelligible information (whether in advertisements, manuals, product documentation, 
or information from retailers). Large corporations have some advantage here, as they are significant 
customers and have in-house IT staff able to persist with asking the right questions. 


Legal constraints and fear of litigation are presently restricting information provision. 


Testing schedule (which are on the critical path for all Year 2000 project plans) depend on the availability of 
Y2K-compliant hardware and third-party software. Any supplier delay or defect will affect project progress. 


3.3 Legal Implications 


The threat of major contractual liabilities and no insurance cover may encourage or force some suppliers 
into liquidation. This could have a disastrous effect on organisations that were relying on their products or 
services. 


The issue of “who pays for Year 2000” can delay the start of remedial work. EDS has successfully 
negotiated cost-sharing agreements with several customers to avoid this problem. 


Successful resolution of the Year 2000 problem is absolutely critical to EDS’ business, performance and 
reputation. We are therefore taking every possible action to protect our reputation and preserve our customer 
relationships. 


4. CONTINGENCY PLANS 


Like other reputable IT service providers, we are approached by many organisations (some of which would 
be highly-desirable additions to our customer base) to contract for their Year 2000 programmes. However, 
taking on such work could detract from our commitments to existing customers. It is therefore extremely 
unlikely that we will take on new business of this nature until we are satisfied that our existing obligations 
can be met. 


We are taking strongly proactive steps to ensure that our customers understand the problem and authorise 
work, minimise lengthy tender procedures, maintain a closely-focused project plan and sufficiently supply 
their own user and technical staff to work with our project teams, especially for testing. 


It is extremely difficult to devise effective contingency plans when both the company itself and every aspect 
of its business are IT-based. We are prioritising work on our own systems and liaising closely with suppliers 
to minimise and manage all identified risks. We are also closely involved with our customers’ contingency 
planning. 


On our long-term outsourcing contracts we have recognised the need to prepare both for EMU and the 
Year 2000, and are working on both requirements. 


We recognise that retention of key staff will be crucial to the success of our Year 2000 efforts. We have a 
range of initiatives to retain and re-skill existing staff, and to recruit and train new staff, including 
participation in Modern Apprenticeships in IT and other IT NTO schemes. We are giving the utmost support 
to the new IT NTO, including providing the non-executive Chairman, as we regard this as a vital contribution 
to alleviating the skills shortage in general, and the Year 2000 issue in particular. 


5. GOVERNMENT ACTIONS TO RAISE AWARENESS 


Much action has already Bs taken, but we would recommend that an even higher profile is necessary to 
ensure that overall progress is maintained and accelerated. 


The CCTA books have proved helpful; they should be regularly updated and a related public information 
forum maintained. 
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Given all the concerns highlighted above, we recommend that the Government appoints a Minister for the 
Millennium, with the following remit: 


— Maintain continuing high visibility and high priority for Year 2000 issues; 

— Drive progress towards compliance certification for technology products; 

— Drive the development and implementation of a national Year 2000 contingency plan; 
— Enforce maximum co-operation on Year 2000 issues between government departments; 
— Drive and report on progress on public sector Year 2000 projects; 

— Continue to support the IT NTO through the DfEE and DTI. 


28 November 1997 


APPENDIX 9 
Memorandum submitted by Barclays Plc 


1. INTRODUCTION 


1.1 Information Technology (IT) is all-pervasive in the Barclays Group world-wide. Barclays has recently 
been recognised as one of the world’s Top Ten users of IT, is the UK’s largest spender on IT and has won 
several awards related to its use of IT. 


1.2 Barclays regards the “Millennium Bug” as a matter of business survival. The Barclays Year 2000 
Programme is the Bank’s top priority, and plans are in place to achieve compliance in our business-critical 
systems by the end of 1998. However, like other organisations, Barclays is heavily dependent on its suppliers, 
service providers, trading partners and customers also achieving compliance. Barclays working assumption 
is that one or more date-related failures will be experienced and that establishing appropriate contingency 
plans is vital. Barclays believes that although much useful awareness raising has been achieved by Taskforce 
2000, Government has a significant role to play in raising awareness and promoting action, particularly 
internationally. 


2. RESPONSES TO THE COMMITTEE’S SPECIFIC QUESTIONS 


2.1.1 What estimation has your organisation made of the seriousness of the “millennium bug” problem to 
your organisation? 


2.1.2 The Barclays Group regards the “Millennium Bug” as a matter of business survival, and is therefore 
approaching it with utmost seriousness. Information Technology (IT) is all-pervasive in the Barclays Group; 
no part of the organisation considers itself immune from the problem. 


2.2.1 What steps have been taken, and when, to avert problems in computer systems and software at the 
millennium? How much work remains to be done to ensure a smooth transition from 1999 to 2000? How 
confident is your organisation that it will encounter no problems at the millennium resulting from the inability 
of computer systems to handle the date change? 


2.2.2 Barclays Year 2000 Programme was established in early 1996. Year 2000 Compliance Projects are 
in place across the Group world-wide. A Programme Board of Senior Executives provides direction for the 
programme. The Programme Board reports to the Group Executive, which is chaired by the Chief Executive, 
Martin Taylor. 


2.2.3 Itis Barclays policy to achieve compliance in its mission-critical systems by the end of 1998. Broadly 
speaking, the majority of Barclays businesses have completed their Year 2000 Assessment and Planning and 
are actively engaged in making the necessary software changes. Enterprise Testing will begin early in 1998. 


2.2.4 Micro-chips with date-processing logic are also incorporated (“embedded”) in many other types of 
equipment, such as building management systems, air-conditioning plants, power distribution and 
management, lifts and office equipment. Date-related failure in many of these could also threaten the 
continuity of business operations. 


2.2.5 It would be the height of folly for any large financial organisation to state today that it is confident 
that it will encounter no problems at the millennium. In a programme of this size and complexity, the prudent 
working assumption must be that somewhere, at some time, one or more date-related failures will be 
experienced. 


2.2.6 The Barclays approach aims to reduce the incidence and severity of any such failures, and to have 
in place appropriate contingency arrangements. 


2.3.1 What, if any, are the major constraints on your organisation which may hinder work on averting 
computer system and software failures at the millennium? 


2.3.2 The major contraints which may hinder our own work are: 
— the availability of suitably skilled IT personnel and other resources; 
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— the resources required to address EMU in the same time-frame; and 
— legal and regulatory changes imposed by Government. 


2.3.3 However, there are many factors outside our control which will have a significant impact on our 
ability to prevent date-related failures at the millennium. Like all other financial institutions, Barclays is at 
risk from Year 2000-related failures in business partners’ systems and Banking industry networks both in the 
UK (eg CHAPS) and internationally (eg VISA, SWIFT). 


2.3.4 Other areas of potential impact include: 
— the compliance of Governments and the services they provide; 
— Central Banks; 
— utilities (power, water, gas, telecommunications, postal services); 
— suppliers; 
— trading partners; and 


— customers. 


2.4.1 Has your organisation developed contingency plans should computer systems fail at the millennium? 
What would be the consequences of such a computer failure for your organisation? Whom would you hold 
to be responsible? 


2.4.2 Barclays approach to the Year 2000 problem is based upon the identification and mitigation of risk. 
As part of that approach we are identifying and developing contingency plans. 


2.4.3 The consequences of any single Year 2000 computer failure for Barclays could vary widely. 
Depending on the circumstances, these could range from, at worst, total collapse of one or more Barclays 
businesses, through insidious data errors, to, at best, minor inconvenience. 


2.4.4 Responsibility for any given date-related failure will depend upon the contractual terms in place 
between the parties at the time. However, Barclays takes the position that, whilst sensible legal safeguards 
must be put in place, relying on legal remedies to address the problem is illusory. There is no substitute for 
addressing the problem actively and directly with suppliers, customers and trading partners. 


2.5.1 Do you think that the Government has done enough to raise awareness of the potential problems 
that may be caused by the millennium bug? Has it done enough to help find solutions to the problem? What 
more could be done? 


2.5.2 The potential consequences of the “Millennium Bug” pose a very real threat to the ability of any 


organisation, industry sector, or even nation state, to continue to function. K 


2.5.3 Taskforce 2000, and Robin Guernier in particular, has done a great deal to raise awareness of the 
Year 2000 problem in industry despite a severe lack of funding. However, it is our perception that many in 
the Small and Medium Enterprise sector, and the general public, are either still largely unaware of, or do not 
comprehend the impact that the Millennium bug could have if not addressed in time. Barclays has actively 
provided awareness raising material to all of its business customers. 


Like others involved in this issue, we are concerned that the Government gives a lead to the effort to 
publicise and advise public, corporate and other bodies of the dangers and how to respond. The recent 
announcement to set up Action 2000 is a welcome step but it is important that this body is adequately 
resourced so that it can make a difference. 


2.5.4 Government has an important role in raising awareness domestically, both with industry and the 
general public. However, we recognise that there is a difficult balance to strike between raising awareness and 
inciting panic. The public in particular need to be given the confidence that the problem is being taken 
seriously and actively addressed. In this respect, Government has particular responsibility to ensure the 
continued operation of vital services, such as the National Health Service, Sccial Services, Pensions, Fire, 
Police and Ambulance Services, Local Government and Defence. 


2.5.5 Government also has a vital role to play in raising awareness and fostering prompt action in the 
international sphere. In particular: 


— with other Governments and regulators, especially in developing countries where awareness is 
still poor; 


— with Central Banks; 
— with the European Community (where the focus appears, still, to be mainly on EMU); 
— The Commonwealth; and 
— International Telecommunications 
28 November 1997 
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APPENDIX 10 
Memorandum submitted by Cap Gemini UK Plc 


INTRODUCTION 


Cap Gemini is the largest European Management Consultancy and IT Services organisation employing 
over 29,000 staff around the world. Our mission is to help organisations use IT to run their businesses better. 
This prominent position in the IT services market has meant we have been working with hundreds of clients 
across the world to address the Year 2000 problem, and have a comprehensive range of Year 2000 services 
and solutions—TransMillennium Services™. As a result of our experience and range of services we are 
recognised by many including independent industry watcher Gartner group as one of the leading Year 2000 
solutions providers, and one of the very few able to offer comprehensive Year 2000 services. 


SUMMARY 


Cap Gemini has created a Millennium Index which we believe provides the most comprehensive 
information available about the state of readiness and likely impact on the UK economy of the Year 2000 
problem. The Index shows: 


— The UK problem to be £23 billion. 
— Demand for skills exceeds maximum supply in April 1998. 


— One in 10 organisations representing 29 per cent of GDP will fail to complete their programmes by 
December 1999. 


— Ifthe timetable slips by 1 quarter, non-completion rises to 27 per cent of organisations representing 
37 per cent of GDP. 


— Eight out of 10 (80 per cent) of organisations will not complete their Year 2000 projects by 
December 1998. 


It is clear from the findings that British organisations (public and private) are unprepared and under- 
resourced for the challenge posed by Year 2000. They have failed to recognise that due to project length, and 
or skills supply constraints, projects will not be complete by the drop-dead date December 1999 and 80 per 
cent of organisations will not complete their projects by December 1998. 


This is exacerbated by the complex inter-relationships within the economy; if even a tiny number of key 
organisations such as utilities, banks or central Government departments such as the DSS miss the deadline, 
the knock on effects would cause severe economic disruption. Only the government can take responsibility 
for ensuring that this does not happen. 


MAIN PoINTs 


For several years Cap Gemini has been concerned globally about the state of readiness of organisations 
about the Year 2000; the more companies we work for in Year 2000, the more alarmed we become about the 
impact of Year 2000 on economics around the world. This type of anecdotal evidence has, however, served 
only to generate a lot of heat and emotion. 


Cap Gemini therefore decided to create its Millennium Index to put some substance into the debate to 
provide precise figures about the levels of supply and demand for Year 2000 resources and the consequent 
impact on the UK economy. Cap Gemini’s Millennium Index sets out to answer three fundamental questions: 


— how big is the problem; 
— what resources will be required; and 
— how many organisations will not complete their Year 2000 programmes in time. 
We believe this is currently the most comprehensive information available about the state of readiness and 


likely impact on the UK economy of the Year 2000 problem. Although it leaves a number of questions 
unanswered, it does provide some alarming findings—the headlines are as follows: 


— One in 10 organisations (11 per cent) will fail to meet the Year 2000 deadline and, because many of 
these are larger organisations, this figure represents 29 per cent of Gross Domestic Product (GDP). 


— Ifthe timetable to fix the millennium bug slips by a single quarter, 27 per cent of organisations would 
fail to meet the Year 2000 deadline, representing 37 per cent of GDP. 


— Ifone takes the deadline for fixing as December 1998 (because during 1999 systems will call up dates 
into the next century and if they are not fixed and tested they will start to work incorrectly or fail) 
which is when most organisations plan to complete their core business systems, eight out of 10 
organisations (80 per cent) will not complete their programmes by this date. 


— Demand for IT skills to fix the Year 2000 problem will exceed maximum available supply by April 
1998. This figure assumes that 50 per cent of the entire UK IT skills pool will be diverted to work 
on Year.2000 projects—by, for example, scaling down other IT projects. 
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Fixing the millennium bug will cost UK organisations £23 billion in total, with an average cost of 
£200k for small organisations, £400k for medium-sized organisations and £2 million for large 
organisations. These figures conceal wide variations, with some organisations spending over £100 
million on tackling the problem. 


These points are illustrated in the graphs below. 


Is there enough resource? 
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How many will not complete on time? 
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OTHER KEY FINDINGS INCLUDE 


Most organisations in the UK have only commenced their Year 2000 programmes in the past year— 
40 per cent of respondents started work between January and June 1997, with a further 11 per cent 
starting between June and October. 


Organisations remain complacent about the difficulty of resourcing the Year 2000. Only 24 per cent 
of respondents belieVe the skills shortage is a risk to their Year 2000 programme. More importantly, 
only 36 per cent of respondents have secured adequate resources from external solutions providers 
and contract IT staff to fix the Year 2000 problem. 
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— The percentage of work completed for critical applications varies from sector to sector with Retail 
and Wholesale (35 per cent) and Finance (33 per cent) having made the most progress; 
Manufacturing (28 per cent), Transport, Utilities and other services (27 per cent) and the Public 
Sector (25 per cent) are lagging behind. 


— The percentage of Year 2000 budget spent to date varies between the sectors: Retail and Wholesale 
(26 per cent), Finance (29 per cent), Manufacturing (24 per cent), Transport, Utilities and other 
services (27 per cent) and the Public Sector (15 per cent). 


— 44 per cent of survey respondents believe the most important single step the Government can take 
is to get its own house in order. However, the Government is making the slowest progress to date 
with only 25 per cent of work on critical applications in the public sector completed. 


MILLENNIUM INDEX METHODOLOGY 


It is planned to update the Millennium Index quarterly to monitor progress. The Index was constructed 
using an advanced Operational Research Model, which has been populated with data from three main 
sources as follows: 


— AnIDC survey conducted on behalf of Cap Gemini, of 300 organisations (private and public) to 
provide information about the status, spend and staff requirements of their Year 2000 projects 


— Cap Gemini’s experience of Year 2000 project phasing 


— Figures from Richard Holway’s (Independent IT market analyst) 1997 report detailing available IT 
resources in the UK (in-house and external) 


WHAT DOES THIS MEAN FOR THE UK? 


It is clear from the first findings of the Millennium Index, that British organisations are, as yet, unprepared 
and under-resourced for the challenge posed by Year 2000. Although they may individually feel confident 
about their own plans, almost without exception, organisations don’t understand the size and duration of 
Year 2000 projects and have taken no account of the skills supply constraint that is going to become acute 
early next year. 


If one considers the issue of interdependencies between organisations that underlies the way organisations 
work today, the Millennium Index shows an alarming proportion of organisations (all of whom trade with 
or supply other organisations) will not complete their projects in time the knock on effect within the economy 
will be significant. However, if those that don’t complete are involved in the infrastructure of the economy 
hospitals, banks, paying benefits, power—the result will be disastrous. 


ANSWERS TO SPECIFIC QUESTIONS 


1. What is your estimate of the seriousness of the millennium problem? 


The year 2000 problem is like looking for land mines in computer systems. The implications of not finding 
and fixing the respective systems varies from company to company and system to system. In essence it is all 
about managing risk and ensuring that not only your own systems will function correctly, but also those of 
your customers, suppliers and partners will do so too. The country wide implications for the UK are 
addressed for the first time by Cap Gemini’s 1997 Millennium Index, and it shows the UK problem to be 
£23 billion. 


2. To what extent do you think that UK business and other organisations (eg Government) have done, or will 
have done to avert any potential problems; 


The Cap Gemini Millennium Index shows that organisations have started their projects too late given the 
average length of the projects and the resource constraint they will face; we would conclude that the action 
taken so far is too little too late and 27 per cent of GDP will impacted. 


3. Do you think that the Government has done enough to raise the awareness of the problems associated with 
the date change or to encourage action to avert problems? What more should be done? 


Taskforce 2000 has increased awareness in the UK (as compared to the level of awareness in continental 
Europe and USA) however, this has not on the whole translated into understanding by business directors 
and managers of the risks of the Year 2000 project not completing according to plan. Action 2000, although 
welcomed in broad terms does not appear to have the focus or dedicated effort that is going to be needed if 
the UK is to avoid some potential disasters. For example the whole “infrastructure” issue needs to be owned 
and managed. If hospitals, certain central government departments, power suppliers etc are amongst those 
who do not complete in time, the effort of this would be severe economic disruption if not civil unrest. 
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4. What, if any, are the major constraints militating against progress being made towards identifying and 
applying solutions to prevent computer system and software failures at the millennium? 


The major constraints are lack of time and resource. For the former the only solution, depending on when 
you started and how long your project is anticipated to be, is to ruthlessly priortise and fix/replace the critical 
systems first, particularly those upon which other organisations depend on having strategic importance to the 
economy. 


As far as resource constraint is concerned, productivity improvement is the only answer. Trying to 
“import” skills for “off-shore” may solve a few individual problems, but will not be the solution for the UK . 
as a whole. 


1 December 1997 


APPENDIX 11 
Memorandum submitted by Railtrack ple 


INTRODUCTION 


Railtrack owns and operates the UK mainland’s railway infrastructure and is indispensable to the safe, 
reliable and continuing provision of rail passenger and freight transport. Railtrack has publicly stated 
(25 March 1997) its absolute commitment to ensuring that its operation will not be jeopardised by the Year 
2000 date change. The company has committed significant funds and a dedicated management team to 
meeting this commitment. Through that team it has taken, and continues to take, a leadership role in ensuring 
that the whole rail industry meets the Year 2000 challenge. In this activity it has the whole hearted and valued 
support of the Office of the Rail Regulator. 


SUMMARY OF EVIDENCE 


The Year 2000 problem is significant and all pervasive across the rail industry. 
Railtrack has an active and well-resourced programme to ensure its own compliance. 
The UK rail industry is collaborating to manage the problem holistically. 


There is a need for urgent and high profile Government action to increase awareness and to remove the 
Year 2000 risks from the public sector. 


RESPONSE TO INQUIRY TERMS OF REFERENCE 


(i) Inability to manage the date change 


Any inability of organisations, public and private, to manage the date change effectively and in good time 
(ie generally before 31 December 1998 not 1999) will have immense repercussions on all other organisations 
and individuals that they trade with or serve. Where systems are safety critical the norm is to fail safe but 
extended failure may in itself induce new economic or social problems. 


(ii) Effectiveness of action taken 


In general action known to have been taken by Government and industry does not give us confidence that 
the problem will be averted. Observations suggest that small businesses and the public sector are the least 
prepared. 


(iii) Role of Government 


Whilst the UK Government has done more than most to raise awareness through Taskforce 2000 and now 
Action 2000 there remains a serious lack of genuine public and managerial understanding and thus action. 
An effort on at least the scale of AIDS awareness or the “Sid” campaign to sell British Gas is needed now. 


(iv) Compliance of new systems and software 


Vendors and retailers are still supplying non compliant hardware and software which adds to the problem 
daily. Urgent action to make this an offence using, if nothing else, the provisions of the Sale of Goods Act, 
would be of immense value but will encounter strong resistance. As far as the domestic consumer is concerned 


action to ensure that Year 2000 compliance rectification has to be included in the cover provided by normal 
and extended warranties would hasten action. 
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(v) Contingency Planning 


Unless significant progress is made over the next six months this will be the only option open to many. 
There will undoubtedly be many cases where contingency plans or workarounds can be implemented by 
having extra staff on duty over the date change. Such staff will have to be identified early in 1999 and then 
be motivated to be at work rather than celebrating the millennium. 


(vi) Legal Aspects 


Whilst no doubt many lawsuits will be launched post hoc they will be too late to be of benefit. Some 
provisions in existing law need to be made more widely known now to prevent the acquisition of problem 
goods or services or to enforce rectification before 31 December 1999. 


SPECIFIC QUESTIONS 


1. The seriousness of the “millennium bug” problem. 


1.1 Railtrack has no doubts about the seriousness, size, complexity, pervasiveness and cost of eliminating 
the millennium bug. Unless addressed systematically, comprehensively and in time the problem would cause 
serious and prolonged damage to the operation and hence the viability of the whole rail industry with serious 
knock-on effects across the economy. 


1.2 The problem goes far beyond the popular conception that it is somehow only related to older computer 
systems. Were this so it would still be difficult and expensive to fix but the problem would at least be tractable. 
Because the problem can exist in so many types of electronic equipment involved in the operation of our and 
our customers’ and suppliers’ businesses the work involved in identifying and eliminating exposure is 
significant. To give an idea of the size, we expect to have to effect elimination procedures on several hundred 
thousand items of equipment. 


1.3 The problem is also much more urgent than is generally appreciated. Far from the deadline for 
compliance being 31 December 1999 Railtrack, along with most other organisations who fully understand 
the problem, have concluded that the deadline for compliance in conventional computer systems is no later 
than 31 December 1998 with many having to be compliant sooner. We would like to set the same target for 
our embedded systems but logistics dictate a target of 30 June 1999. To illustrate how little time this leaves 
for the task, on the date of submission of this memorandum (1 December 1997) there remain only 274 working 
days for the computer systems task. 


2. Preparedness—steps taken and planned 


2.1 Railtrack began to evaluate the problem early in 1996 primarily as it affected computing systems. A 
formal study was conducted between September and December 1996 which identified the much wider scale 
of the problem and its ramifications across the whole rail industry. This estimated the cost of rectification for 
computers only at £60 million for the industry. 


2.2 Following consultations in the industry and with the Rail Regulator, Railtrack organised an industry 
wide Management Conference on 25 March 1997 at which the problem was widely exposed. (A 15 minute 
video of the key points made is available if required). 


2.3 Asa result of the conference an independent Rail Co-ordination Office was set up to assess the industry 
wide readiness and report back in November 1997. Within Railtrack the team that had been evaluating the 
problem was absorbed into a much larger Year 2000 Management Unit with a full time Programme Director 
from 26 May 1997. This unit is now over 45 strong and is actively managing a companywide programme to 
identify and effect the changes needed. 


2.4 The Railtrack Year 2000 Management Unit has broken the problem into four areas each being 
addressed by a specialist team. These are: 


2.4.1 Information Systems—our computers and networks. 

2.4.2 Rail Infrastructure Systems—the physcial railway—track and signalling. 

2.4.3 Property and Premises Systems—stations, depots, offices and other premises. 
2.4.4 Supplier Compliance—ensuring our suppliers operate through the date change. 


The work of those teams is brought together by a Planning and Integration team and the move to 
compliance is monitored by another Change Control team. 


2.5 A very full programme through to 2001 is now in place. The tasks post June 1999 are to ensure that 
what has been made compliant remains so and to monitor the changes through a complete 12 month cycle. 


2.6 Railtrack hosted a Directors Forum on Year 2000 in the Rail Industry on 18 November. Part of the 
time was devoted to ensuring that all companies understand the obligations and risk that Year 2000 pose for 
Directors and Officers. The remainder was to seek support to establish an industry wide Rail Millennium 
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Programme Office to effect active collaboration by all companies. This initiative was supported by the Rail 
Regulator in person and is now under way. We anticipate the cost of resourcing this collaborative effort to 
be between £1 and £1.5 million per annum. This funding will be provided by the industry and does not include 
the actual cost of rectification or replacement. 


2.7 No organisation can be certain that it will be totally free of problems on the day. Our approach of 
informed due diligence is intended to maximise our chance of achieving this. That said, we remain vulnerable 
should other organisations on whom we depend fail. The most significant of these, should they fail, would 
be major utility suppliers, the emergency services and local and central Government services. 


3. Constraints 


At present we have no internal constraints. We can see a growing problem ahead in finding people with the 
skills needed to support compliance work—primarily telecommunications and electronic engineers and 
project managers. The external constraints are compliance failures among suppliers and customers which is 
why we are investing so much time and effort into industry wide collabortion. 


4. Contingency Planning 


Formal processes to create and rehearse contingency plans are part of the rail industry’s normal 
management disciplines. We have therefore already taken steps to apply these processes to the Year 2000. 


5. Government 


As stated earlier, the UK seems better informed than most countries. However on a 1-10 scale, where 10 
is the awareness needed to stimulate action such as Railtrack is taking, the country as a whole is a very long 
way off the mark. As well as increasing focus in this area the Government should help by sponsoring the 
creation of reliable databases of products and companies that have been certified as compliant. 


2 December 1997 


APPENDIX 12 
Memorandum submitted by The British Computer Society 


1. INTRODUCTION 


1.1 This submission has been prepared by the Year 2000 Working Party of the British Computer Society. 
The BCS is the Chartered Institution for Information Systems Practitioners, and a nominated body of the 
Engineering Council. It has 35,000 members, and represents a broad cross section of the working 
professionals in the IT field. It has prepared Guidance information for IT Directors and their senior 
management on the practical steps needed to deal with the Year 2000 problem, as part of a set of good practice 
publications in the IT field, (previously submitted to the Select Committee)’. 


1.2 This memorandum submits that for satisfactory resolution of the Year 2000 problem and to protect 
basic services there is a need to mobilise companies and industries to remedial action in a way which is beyond 
the scope of conventional industry structures and which may therefore require political enabling both 
nationally and internationally. 


2. THE PROBLEM AND ITS POSSIBLE CONSEQUENCES 


2.1 Nature and scale of the Year 2000 problem for organisations 


2.1.1 The most frequently reported aspect of the problem is the cost of compliance. What is hardly ever 
reported is the consequence for an organisation if the work was not done. We live in an automated world and 
microchips have permeated nearly all areas of our personal and business lives. Yet the possibility that the 
basics of subsistence could be at stake, the availability of normal government and public services, the lifeblood 
of commerce under threat and even the possibility created of concurrent industrial catastrophes and defence 
impotence are dismissed as hype or exaggeration. But no-one would deny that all these things individually 
can happen if design principles are neglected, procedures ignored or if essential maintenance is withheld. 
Failure to find the Year 2000 weaknesses lurking in the fabric of today’s complex and interdependent 
technological world is no different. It is to be hoped that the real downside is less than this and that specialists 
will detect and correct in advance most of the life-threatening or business critical errors. But it is also crystal 
clear that the public at large has no inkling of the potential power of the flaw that lies dormant beneath the 
surface of modern life. Neither do people grasp the difference between a plant or system being down for a 
few hours (annoying) and being out for weeks (devastating). Major companies recognise that in the event of 
loss of availability of computer systems, three or four days is the longest they can survive before getting into 
serious trouble. 
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2.1.2 The level and understanding, of organisations around the world, of the various aspects of the Year 
2000 problem varies considerably. Many people naturally find it difficult to understand why this is a major 
problem, let alone the largest technical problem in history. But the following are relevant: 


2.1.2.1 Practically, the logistics per company are huge: tens of thousands of intelligent devices 
in plants, and libraries of software comprising anything from 5,000 to 100,000 programs. 


2.1.2.2 Philosophically, the notion of sequence lies at the heart of automation and IT. This 
concept of sequence so often hinges on the date. In other words the Year 2000 problem is a central 
design flaw in a constellation of industries, not a peripheral inconvenience. 


2.1.2.3 Visibility; the temptation is to react only in proportion to the visible magnitude; to do 
so is to be sucked into a reactive spiral from which there is no escape. 


2.1.2.4 Psychologically, a “progress mindset” assumes things will go on working as before. 
Instinct and common sense are baffled by the problem because it is hidden, latent and dormant. 


2.1.2.5 Managerially, competitive pressures and the agenda of corporate renewal compete for 
attention and compromise the priority that as a survival issue the problem requires. 


2.1.2.6 Technically, “time machine” test environments are still only in their infancy and, for 
industrial automation, not yet fully defined. In other words very little has been tested yet. 


2.1.2.7 Scope. progressively has grown, first it was just IT. Now all electronic intelligence is 
suspect, bringing the need also to address all industrial and domestic automation. 


2.2 The consequences considered 


2.2.1 Taking the 6-9 month period straddling the turn of the century as that in which failures would be 
most concentrated, there are a range of global scenarios which are foreseen given the current understanding 
of the actions that are currently being taken to address the various aspects of the problem. These scenarios 
are provided in the Appendix and summarised below: 

2.2.2 The following are our current best estimates of the possible range of global consequences for the four 
main areas of “IT Applications”, “IT and Communications Infrastructure”, “Industrial Automation”, and 
“Commercial Issues”. The likely outcome for each aspect, given the current rate of progress, will obviously 
lie between the ranges of the Best and Worst Scenarios. 


2.2.2.1 IT Applications. The best outcome that can be foreseen are some widespread minor 
disruptions whilst a worst case scenario would be widespread disruptions leading to business 
failures and acute overload on IT resources needed to re-instate systems. 


2.2.2.2 The IT and Communications Infrastructure. The best scenario would be some isolated 
difficulties. However the worst scenario, particularly for global communications, would be 
widespread difficulties. Given that the actual likely situation would lie between these boundaries, 
it could be foreseen that there will be pockets of communication failures affecting some countries 
around the world. 


2.2.2.3 Industrial Automation. This area is of concern and even the best scenario foreseen 
would be for failures ranging from minor through to prolonged shutdowns. The worst scenario 
however would be widespread failures some affecting basic utilities and public services with 
possibly some HSE (health and safety) incidents. Organisations need to address this area as a 
matter of urgency. 


2.2.2.4 Commercial Issues affecting the business chain. The best outcome foreseen is that the 
resilience of most business sectors proves adequate to contain failures. The worst scenario would 
be a widespread pattern of difficulties in the business chain, with an overload in the legal system 
as organisations seek to make redress. 


2.3, Overall Outcome 


2.3.1 The eventual outcome however will be an amalgamation of the four ranges above. The precise nature 
of this is not easy to estimate. However it is likely at the least that some impact on the economies of nations is 
foreseeable. It cannot be ruled out that the compound effect could undermine availability of essential services 
causing social as well as economic disruption. How long does a national power cut have to last to become a 
political issue? 


2.3.2 What is clear is that there still remains an opportunity to mitigate the worst consequences of the 
scenarios, provided that the current level of remedial activity is increased. The current mould of gradually 
escalating reaction (inappropriate against a fixed deadline) needs to be broken and replaced by the active 
mobilisation appropriate to a foreseeable crisis. 


2.3.3 Having outlined our understanding of the potential consequences arising from the problem we give 
below some brief comments regarding some of the other issues mentioned in the Select Committee terms of 
reference. 
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3. STATUS OF REMEDIAL ACTION AND MAJOR INHIBITORS 


3.1 Status in the UK 


3.1.1 In the IT arena we believe remedial action in the UK has been characterised by too slow an 
awakening, given that the problem is known and publicised. Of particular concern is the effect on IT intensive 
sector such as banking, finance and the media. Also of concern are the needs of small and medium enterprises 
(SMEs) which frequently lack in-house IT skills. 


3.1.2 The status for industrial automation and embedded controls is of great concern in view of: 


— jndustrial automation not being generally recognised as subject to the problem until 1997 which has 
delayed developing any body of expertise to tackle it; and 


— possible impact of problem directly on process industries providing basic services such as electricity, 
water and gas; also the health and defence sectors. 


3.2 Major inhibitors to progress in the UK 


3.2.1 Two major barriers to progress in resolving the problem are: 
3.2.1.1 Conflicting messages from: 


— the IT industry, which has not responded clearly, with few senior industry leaders 
prepared to speak out and IT companies limiting their statements to their immediate 
products, leaving the user community to interpret the real significance; 


— the engineering industries, in which most companies assumed this was an IT-only issue 
and, having started much later, are about three years behind the IT community; 


— government, which on the one hand has appointed Taskforce 2000, and then Action 
2000, and on the other hand has government departments which are denied extra 
funding to address resolution; and 


— academia, which has a focus on methodology rather than the installed base in the field. 


3.1.1.2 Business Priorities which are inappropriate to an issue affecting survival of an 
organisation: 


— very few corporate leaders have made a public issue of their Year 2000 programmes, 
and, more surprisingly, few shareholder meetings have insisted on being informed about 
Year 2000 readiness; and 


— within companies, Year 2000 programmes are frequently seen just as another IT project 
and left to fight for resources and attention, increasing the risk of delay. 


4. GOVERNMENT ACTION TO DATE 


4.1 We regard Taskforce 2000 as having provided a much better start than in most other countries and 
Action 2000 likewise is to be welcomed. However, there is concern evident among some of the front-runner 
industries that are active in addressing the problem that they will barely have enough time. It is observed that 
different industry groupings go through a learning curve and then this pattern repeats with their feeder 
technology suppliers as well as their supplier/customer business chains. The problem is that we are running 
out of century for these consecutive learning curves to have time to operate. Therefore we believe that 
consideration should be given to political measures to facilitate faster mobilisation to action by the various 
industry and public sectors. These are outlined in the next three paragraphs. In particular we are concerned 
that Action 2000 has only got one current chance to be successful. 


5. THE ADVERSE PSYCHOLOGICAL BALANCE 


5.1 Problem solving situations either follow a crisis response (mobilisation) pattern for visible needs or else 
an innovation learning curve. But the Year 2000 problem is hidden and, apart, from a slowly growing case 
history of failing systems, remains below the surface. Therefore knowledge of the problem has failed to 
provoke the international activity appropriate to the situation. Furthermore, the nature of modern regulatory 
and legal structures which evolve with, rather than ahead of, problems has little to offer in this case, except 
to discourage the world-wide collaboration which could solve it. Therefore the challenge is to identify ways 
of changing for the positive this negative balance: 


5.1.1 Leadership 


Few business leaders who are facing up to the problem have been prepared to issue attributed testimonials. 
Too much is at stake on the downside in terms of reputation and effect on share price. Some knowledge of 
the real case studies does exist but it is mainly shared only at the practitioner level. People will believe their 
own peer group—they will riot believe the IT industry. 


Government action is needed now both in the UK and in international spheres to promote public 
recognition that the problem is real and could have serious social and economic consquences would be timely. 
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5.1.2 Regulatory bodies and industry sectors 


Many existing regulatory structures such as HSE may need no further modification to render their normal 
statutory requirements applicable also to the Year 2000 problem. In some cases specific interpretation and 
modification will be needed. However, the pressure on companies again is negative. 


Government action could task key industry sectors as a whole to demonstrate readiness for Year 2000 and 
seek to use regulatory mechanisms to facilitate Cupertino within such sectors and enable sectors collectively 
to retain public confidence through joint action. This could help individual companies to address the problem 
while avoiding the limelight and also help the government to avoid the appearance of taking ownership of 
solving the problem. 


5.1.3 Legal issues 


On the one hand, advisors such as accountants and auditors are cautious to give advice because of the 
potential risk of subsequent legal action. On the other hand, there are many laws and regulations which could 
be invoked against organisations which fail in their duties because of Year 2000 problems, in order to 
stimulate them to action. 


Government action to raise awareness of these and how they could apply would add urgency to remedial 
work. It would also highlight any situations inhibiting remedial action where a dispensation mechanism 
should be sought. 


5.1.4 EMU 


It is unlikely that there are sufficient IT resources to complete both the preparations for EMU and Year 
2000 at the same time. 


Government action could recognise the interaction of these two issues. 
5.1.5 SMEs 


The SME community is especially vulnerable to the Year 2000 problem due to lack of awareness and 
because they frequently do not have in-house IT resources. 


Government action to facilitate meeting the needs of SMEs, by means including provision of advisory 
material and publicity, is therefore supported. 


6. COMPLIANCE OF CURRENT SOFTWARE 


6.1 It is of concern that, contrary to some press reports, the infiltration of the problem is by no means 
restricted to old software but occurs in all areas of computing and automation whether recent or not. The 
principal hindrances to “stopping the rot” are slow realisation by those creating these products and the lack 
of availability until very recently of test methods and facilities for forward dating. 


Government action could be considered with the aim to give public recognition of the issues inhibiting 
information sharing about compliance of products through fear of litigation and to explore any measures 
such as a certification scheme to create incentives for companies to be open about their products. 


7. CONTINGENCY PLANNING 


7.1 It is essential to emphasise that normal business and operational contingency planning by companies 
or public agencies will need further development to cover the increased difficulties should simultaneous 
failures occur and in order to keep vital services, such as gas, electricity and water flowing. Government action 
could consider facilitating appropriate contingency planning, such as the Civil Defence approach for 
communities, or “end-to-end” contingency planning (in which all players institute shared emergency response 
mechanisms) for such key services as the utilities. 


8. CONCLUSION 


8.1 What needs to be avoided is the sentiment enunciated by Winston Churchill on 2 May 1935. “When 
the situation was manageable it was neglected, and now that is thoroughly out of hand, we apply too late the 
remedies which then might have affected a cure” and continues: “There is nothing new in the story....... It falls 
into that long, dismal catalogue of the fruitlessness of experience and the confirmed unteachability of 
mankind. Want of foresight, unwillingness to act when action would be simple and effective, lack of clear 
thinking, confusion of counsel until the emergency comes, until self-preservation strikes its jarring gong— 
these are the features which constitute the endless repetition of history.” 


8.2 The more we can discover better ways to work together globally the more chance we have to contain 
the problem. 


1 December 1997 
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Annex 


DETAILS OF SCENARIOS INDICATING RANGE OF CONSEQUENCES 


If unaddressed from now on, the consequences of the Year 2000 problem would be much more serious than 
the likely actuality following world-wide remedial work over the remaining time. However there is much 
uncertainty in current understanding of how effective the remedial programmes will prove to be, thus there are 
arange of outcome scenarios which can be foreseen. The following are our current best estimates of the possible 
range of global consequences for the four main areas of “IT Applications”, “IT and Communications 
Infrastructure”, “Industrial Automation”, and “Commercial Issues”. The likely outcome for each aspect, given 
the current rate of progress, will obviously lie between the ranges of the Best and Worst Scenarios. 


IT Applications 


IT Applications - Year 2000 - what will happen? *** 
*** Maturity of world body of understanding = good 


This topic has become increasingly active from the early 1990's 


















High Potential impact of problem as it exists today (1997): 
most IT systems would malfunction or seize 
causing global chaos 
Potential 
impact of Worst | ie 
problem if scenario 
steps are Widespread disruptions - business 
not taken failures include some "spiders" in 
to overcome the "web" of business 
its effects 
Best 
scenario *** Widespread minor disruptions 
Low 


1997 1998 1999 2000 
Progress of remedial action 


The understanding of the IT application aspects of Year 2000 is good and organisations have been working 
on the problem since the early 1990’s. That said there are still a significant proportion of organisations that 
are still not actively pursuing programs that will achieve the deadline. This in itself will have a domino effect 
on the business chains of those organisations that are pursuing compliance. Given this background the best 
outcome that can be foreseen are some widespread minor disruptions whilst a worse case scenario would be 
widespresd disruptions leading to business failures. 


IT & Communications Infrastructure 


IT & Communications Infrastructure - Year 2000 - what will happen? **(*) 
**(*) Maturity of understanding: IT platforms = good; Communications = fair 


Topics active from c. 1994 













High Potential impact of problem as it exists today (1997): 
globally progressive degradation of IT services 
and communications 
Potential 
impact of Worst | 
problem if scenario **(*) 
steps are Widespread difficulties, 
not taken (national loss of dial-tone believed unlikely) 
to overcome 
its effects 
scenario **(*) Isolated difficulties 
Low 


1997 1998 1999 2000 
Progress of remedial action 


The state of progress for IT applications and its inter-relationship with the IT infrastructure has lead to a 
degree of maturity in this area. The telecommunications field however, due to the specialist knowledge 
required, is less well understood. It is also more difficult to test. The situation world wide is therefore less 
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mature and carries greater attendant risks of failures. The best scenario would therefore be some isolated 
difficulties however the worst scenario, particularly for global communications, would be widespread 
difficulties. Given that the actual likely situation would lie between these boundaries it could be foreseen that 
there will be pockets of communication failures affecting some countries around the world. 


Industrial Automation 


Industrial Automation - Year 2000 - what will happen? * 
* Maturity of world body of understanding = low 


This topic only became active to any degree at start of 1997 
High Potential impact of problem as it exists today (1997): 

failures globally, some prolonged, some affecting availability 

of basic utilities or public services .....some HSE incidents 


















Potential 
impact of Worst 
problem if scenario * 
steps are Widespread failures some affecting availability 
not taken of basic utilities or public services 
to overcome HSE incident(s)??? 
its effects 
Best 
scenario * Failures ranging from minor through to 
prolonged shutdown 
Low 


1997 1998 1999 2000 
Progress of remedial action 


With regard to the four areas under consideration this area is probably the least understood and has to 
date received the least attention. It is technically more complex than the other areas and requires the highest 
degree of specialist knowledge. In book II an approach was outlined for assessing the risks for organisations 
with widespread process automation. Even the largest organisations in general are still in this stage of 
inventorisation, risk assessment and dialogue with vendors, with very few having progressed into testing for 
critical areas of business and service continuity. The specialist skills required to carry out this testing in terms 
of process control and instrument engineers are relatively scarce by comparison to IT staff and this combined 
with the careful planning of testing that is required in companies with highly integrated automation plants 
will lead to delays in addressing the problem. It is estimated that the number of specialist engineering staff in 
this area in the UK represents by comparison only some three per cent of the numbers of IT staff available 
to address the IT issues. 


This area is therefore of concern and even the best scenario foreseen would be for failures ranging from 
minor through to prolonged shutdowns. The worst scenario however would be widespead failures some 
affecting basic utilities and public services with possibly some HSE (health and safety) incidents. 
Organisations need to address this area as a matter of urgency. 


Commercial Issues 


Commercial Issues - Year 2000 - what will happen? * 
* Maturity of world body of understanding = low 


This topic became increasingly active in 1996 


High Potential impact of problem as it exists today (1997): 


globally the business chain could grind to a halt 


















Potential 
impact of Worst 
problem if scenario * 
steps are Widespread pattern of difficulty in business chain 
not taken (even gridlock). 
to overcome Legal system is overloaded. 
its effects 
Best 
scenario * Resilience of most business sectors proves 
adequate to contain failures 
Low 


1997 1998 1999 2000 
Progress of remedial action 
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It is difficult to separate some of the issues under this heading from those above as the issues are inter- 
related. However despite the maturity of understanding of the IT issues the consequences within the business 
chain of the dependencies on customers and suppliers also addressing the challenge in all its various aspects is 
less well understood. The commercial issues also encompass inter alia legal, insurance and business continuity 
planning aspects. The topic became increasingly active during 1996 and 1997 and the maturity of 
understanding may rise to fair during 1998. That said even large organisations rely on SMEs (small to 
medium sized enterprises) for their operational survival and it is in the SME area that the understanding is 
lowest. The best outcome foreseen therefore is that the resilience of most business sectors proves adequate to 
contain failures. The worst scenario would be a widespread pattern of difficulties in the business chain with 
an overload in the legal system as organisations seek to make redress. 


OVERALL OUTCOME 


The eventual outcome however will be an amalgamation of the four ranges above. The precise nature of 
this is not easy to estimate however it is likely at the least that some impact on the econimies of nations is 
foreseeable. 


APPENDIX 13 


Letter to the Clerk of the Committee from Mr Chris Earnshaw, Managing Director, British 
Telecommunications plc 


I am pleased to enclose the submission concerning the above from British Telecommunications. 


BT regards this issue as of major importance to the UK and a major threat to business world-wide. Business 
failure through Year 2000 can lead to revenue loss for other businesses and a potential domino effect 
impacting even on tax revenue. Yet there is a very variable awareness of Year 2000 problems both in the UK 
and overseas. This can only lead to frantic activity in 1999 as countries and businesses try to win first call on 
increasingly scarce skilled software engineering resources. This will be exacerbated by the introduction of the 
Euro, despite the recent UK Government decisions. 


No one company can control all of the issues. For example, across any one geographical area a whole range 
of companies, public sector organisations, and utilities must remain in operation if the basic infrastructure 
is to be in place to support health, transport, power, communications and everything else on which companies 
and their employees depend. This makes the prospect of Year 2000 guarantees impractical. What is important 
is that every business should analyse its operations immediately and even before the analysis is complete, take 
action to protect critical systems and processes. 


There is a clear role for Government in promoting common objectives in the UK and overseas but this 
needs to be an active role and not just information dispensing. If BT can help further, then we will be only 
too pleased to do so. 


The information contained within the memorandum may be freely distributed—we do not believe that it 
is sensible to regard Year 2000 as an opportunity to gain competitive advantage and have been free with our 
experiences and time, including agreeing to chair an International Telecommunications Union taskgroup. We 
have supported Taskforce 2000 and will willingly work with Action 2000, if this will focus more attention on 
resolving the critical issues. 


2 December 1997 


Memorandum submitted by British Telecommunications plc 


1. INTRODUCTION 


BT is a major user and producer of software, hardware and embedded systems. This memorandum is based 
on our well-advanced Yr2000 programme, our experience of major software change programmes such as 
PhONEday (telephoning dialling code change) and our contacts on Yr2000 with companies in the UK and 
overseas. 


2. SUMMARY OF EVIDENCE 


_ Yr 2000 is neither a single nor just a technical problem. For example, business continuity issues such as the 
impact on the supply chain are as challenging as the IT issues. 


Yr12000 issues will be found on 50-80 per cent of systems and hardware. 


Detailed internal surveys are'the only sure way of fully assessing Yr2000 impact but business critical system 
modification should start immediately. 


Businesses yet to start should concentrate on critical systems and on contingency plans. 
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Active companies like BT have put pressure on large business suppliers to initiate Yr2000 programmes, 
with a positive knock-on effect to smaller companies. 


The major issues for the UK are: 
— resources to resolve Yr2000, the Euro and Code Change; 


— lack of co-ordination of Yr2000 effort on the UK infrastructure. No one company can control all 
of the Yr2000 issues; and 


— the potential impact on global communications and finance due to lack of awareness and action on 
Yr2000 outside N America and the UK. 


3. PROBLEM DEFINITION 


3.1 BT participated extensively in the BSI work to define the Yr2000 problem and we have promoted this 
definition here and overseas. We also insist that compliance means tested against the BSI definition using our 
technical test specifications. 


3.2 Yr2000 is not a single technical problem but an array. For example, the digits 00, 99, 9/9/99, 31/12/99 
can be used to give other, specific instructions within a programme—such as “no end date”. Also, as software 
is not just found in computers but in embedded chips controlling electrical and mechanical equipment, it 
affects transport and energy systems, lifts, fire and security alarms, tills etc. 


4. BT AcTIVITY AND TARGETS 


4.1 We established a dedicated project team in January 1996. The Yr2000 problem is “owned” on behalf 
of BT by Chris Earnshaw, Managing Director Networks & Systems and a member of the main operations 
board. It is closely monitored at Board level and through internal audit. 


4.2 Our target is to be “Yr2000 ready” by 31 December 1998. This is not to provide a 12 month safety net 
but to: 


— recognise that many systems will meet their first transaction with a Yr2000 date during 1999; 


— allow thorough field trials by both BT and our customers in 1999. The field trial will test for user 
interaction problems and customer site issues; and 


— test production using new software of the last full year accounts pre 2000. 


We do not employ a single method of correction as, despite claims to the contrary, a single solution does not 
exist. Date expansion (to 4 digits) can significantly reduce systems efficiency so we match solution to situation. 


4.3 We will complete standalone tests and end to end “integration” testing before December 1998. Testing 
is one of the most complicated and expensive parts of the programme. 


4.4 Our programme reflects both the effort involved for a high technology, global company and also the 
responsibility we feel to be proactive. We have: 


— taken the lead in establishing dialogues with UK and overseas telecommunication companies, with 
OFTEL, and also with standards bodies such as the International Telecommunications Union and 
European Telecommunications Networks Operators forum; 


— sought regular discussions across a range of industries to share experiences and best practice and 
participated in the BSI Yr2000 and Taskforce2000 initiatives; 


— shared lessons from probably the biggest software change programme in the UK to date— 
PhONEday; 


— shared the generic test checklist that we have built; and 


— provided guidance on supplier relations—we have had greater than 60 per cent response rates from 
suppliers compared with the typical 20-30 per cent. 


5. LEGAL AND REGULATORY ISSUES 


5.1 Our legal advice is that Yr2000 does not introduce any new issues though the threat of action in media 
articles has made suppliers, investment analysts and “legal officers” of companies cautious, particularly in N 
America. BT already has schemes to compensate customers for service failures and we do not intend to 
supplement these with a special Yr2000 guarantee. 


5.2 In terms of UK regulation, BABT approval must be retained by suppliers. (This implicity assumes 
compliant BABT testing laboratories—OFTEL may wish to comment further.) Other regulatory issues are 
confined to change plans for our financial systems which deliver OFTEL reporting requirements. 
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6. POTENTIAL RISKS 


6.1 Supply Chain failure 


If suppliers of our key network and IT components failed to deliver upgrades on time, then our core 
operations would be significantly affected. We judge these risks as low. However, even where supplier 
products may not have a date dependency, they might fail to deliver because their own systems fail. We judge 
these risks as higher, particularly for smaller companies. We are now making specific enquiries of this sector. 
Finally, there are risks to our revenues from business customers failing. 


6.2 Resource 


We expect to spend up to £300m, but money is only part of the problem. Companies will increasingly 
compete globally for resource as the deadline approaches and as other software projects like the Euro and, 
for UK telecommunications, Code Change, impact. 


6.3 Infrastructure 


A failure of power, water, banking etc could severely curtail telecommunications services—and vice versa. 
Transport failure would also threaten our services. The lack of co-ordination of Yr2000 infrastructure plans 
either on a national or regional basis causes concern. 


6.4 International connectivity 


We have addressed this with the ITU and the ETNO forum, but also directly with all countries with whom 
we exchange telecommunications traffic. Evidence suggests some countries have not yet started a Yr2000 
programme including some developing countries who will lack both skills and money. Failure would impact 
not only on calls, but on business operations including transfer of information, international money transfer, 
share dealing; and even the Internet. 


7. CONTINGENCY PLANS 


We have built contingency plans for Yr2000 by extending our existing disaster recovery plans. These cover 
situations such as an inability to take customer orders, to bill customers or pay suppliers. It also covers our 
capability to connect calls, carry TV, radio, utility command information, banking instructions or even food 
stock information between hypermarkets and their central depots. A further issue being addressed is the need 
for extra staff, recorded announcements, helplines etc for the period 31 December 1999 to 10 January 2000. 


8. GOVERNMENT SUPPORT 


Whilst the actions of Taskforce 2000 have increased Yr2000 awareness, there is a need for acceleration and 
increased focus to deliver the following by March 1998: 


— agreed common timescales, compliance definitions and test criteria across the UK would reduce 
suppliers’ testing effort and permit end to end integration testing in the UK during 1998-99; 


— infrastructure co-ordination—given the privatisation of much of this, it may be best addressed on 
a regional basis but readiness, risks and contingency plans need to be assessed and shared; 


— raising Yr2000 and international connectivity as a major issue—on both international and 
European agendas (providing we avoid a time consuming standards-setting exercise or unilateral 
action from other countries). Countries which lack the skills and money to address Yr2000 need 
particular help; and 


— _ all companies to have assessed the implications of Yr2000 for them. All major companies to have 
fully resourced plans, dedicated teams in place, and to have commenced work on the critical 
systems. 


Our view at present is that we will be offering telecommunications service in January 2000 to the normal 
standards, provided the other elements of the national infrastructure also deliver. There are much higher risks 
against the full international telecommunications service. Given that telecommunications are a major 
dependency for the global economy, the issues must stay at the top of the Government agenda, as well as that 
of BT. No one company can control all of the issues. 


December 1997 
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APPENDIX 14 
Memorandum submitted by GPT Limited 


INTRODUCTION 


GPT is involved in the development and supply of telecommunications systems to all the major 
telecommunications operators in the UK. We have a major concern to ensure that those operators’ networks 
continue to operate satisfactorily over the date change. We are also concerned that we can continue to do 
business with our suppliers, partners and customers after the date change. 


GPT believes that it has in place mechanisms to ensure that its products will work and its business will not 
fail due to problems caused by the Century Date Change. GPT also believes that some statements made on 
compliance overestimate the effect faults are likely to have on organisations. 


EVIDENCE 


(The following is set as answers to items in the terms of reference and your supplementary questions ) 


We can only answer the issues you raise in relation to our company and to some extent our customers, 
partners and suppliers with whom we have discussions. In terms of the general level of awareness throughout 
industry it is not practical to offer any opinion. 


(i) The majority of the general purpose software packages that we have tested to date have not had faults 
shown up by Millennium specific testing. On the real-time software used in our products the results have 
shown a very low rate of faults. Many of the faults found during millennium testing have not been millennium 
specific faults, but more general faults not previously identified. Most of the millennium faults found would 
not have had a major effect on the organisation if they had remained undiscovered, many might not have 
been noticed at all. 


Whilst telecommunications systems are not technically “safety critical” in the strict sense of the words, we 
are aware that many users are highly dependent on an available service particularly for the completion of 
emergency and related calls. We therefore treat any failures that could result in the loss of normal telephone 
service over an area in a similar way to safety critical failures. None of the faults we have identified in our 
products has any effect on the ability of our customers’ networks to handle normal telephony or emergency 
calls. The faults all relate to advanced features and network management tools. We have not yet identified 
any safety critical software within our organisation. 


As most software contains faults, we suspect that any exhaustive testing programme of all software, for a 
particular feature would yield a similar result. The major issue with millennium specific software faults is the 
danger that they will all occur at once, rather than the magnitude of any problem. 


(ii) GPT has had a comprehensive compliance programme in place since October 1996. This programme 
sets out to ensure that all our products, internal system and interfaces to other organisations are compliant. 
In December 1996 the Public Network Group of GPT issued a policy statement, this forms that basis on 
which we are working. This programme is overseen by a steering committee with representation from all 
divisions of the company chaired by a senior manager who has overall project responsibility. The evidence 
of action within government is not generally available to us. 


We believe that most other large organisations that we deal with are in a similar state to ourselves. Smaller 
organisations in general have smaller problems and are correspondingly later in tackling some of the issues. 
It is difficult to get a contractual commitment from any organisation to cover compliance due to the nature 
of software problems rather than the special nature of the Year 2000 issues. 


(iii) The government has been far more effective than many other governments in raising awareness. The 
work of Taskforce 2000 and Action 2000 have been very widely reported and is doubtful if government can 
do much more to raise awareness. Further publicity could become counter productive. 


(iv) We are ensuring that all products will be available in a compliant version by the end of 1998. This will 
give customers the opportunity to install such products during 1999, so that they can ensure that their 
networks are fully compliant. Most of our suppliers and customers appear to be working to broadly similar 
timescales. 


_(v) Weare proposing to have a special arrangement to staff our customer help lines over the period during 
which our customers’ system will move from the year 1999 to 2000. We are particularly concerned about the 
situation when two systems intercommunicate when they are in time zones in different centuries. 


(vi) Weare striving with our suppliers and customers to ensure that all disputes are settled without recourse 
to legal action. To this end we have a considerable legal effort employed to ensure that we fully understand 
the legal implications of our actions. Whilst there is good advice available about the situation under English 
law, there appears to be very little information on the situation in other jurisdictions. 


1. We believe that the millennium bug problem will mainly be solved by the actions that are in place. Any 
residual faults are unlikely to have any significant effect on the operation of the machines on which they occur. 
In the case of any particular system failing at the date change, the normal contingency actions, that are in 
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place for dealing with system failure, will be instigated. During 1999 we will audit our contingency plans to 
ensure that they are adequate. 


2. All products currently being supplied by our company are compliant or will be made compliant before 
1 January 1999. We have the impression that most other companies are working to similar timescales. 


3. We have a comprehensive audit programme in hand to test all our internal systems. This includes all 
software and intelligent devices used in the organisation. We will test all systems that have been internally 
generated or modified. We are seeking commitments from all our suppliers that their systems are compliant. 
Systems that are critical to our operation will be tested in addition to getting supplier commitments on 
compliance. We aim to have solutions to make all our internal systems compliant by the end of 1998, where 
there are major activities required to roll-out compliant solutions across the organisation these may extend 
into 1999. 


4. The UK government has done more than most to raise awareness. The government should be working 
with others to ensure that the issue is dealt with as seriously elsewhere. In particular to ensure that financial 
institutions and telecommunications operators across the world will be compliant. We are particularly 
concerned about the position in countries that may not have the resources to solve the problems internally, 
possibly those in Africa and the former Soviet Union. The government’s principle role in the UK should be 
to ensure that all UK public bodies are fully compliant. The availability of databanks should be encouraged, 
but government’s role should be merely to act as an information clearing point. 


2 December 1997 


APPENDIX 15 
Memorandum submitted by International Computers Limited (ICL) 


1. INTRODUCTION 


1.1 ICL is one of Europe’s leading IT systems integration and services company with a successful history 
of large-scale IT projects. As such we have both the project management and technical skills to advise on all 
aspects of the Year 2000 problem. 


1.2 Since 1995 ICL has been actively involved in all aspects of the Year 2000 problem. Our underlying 
policy has been one of openness about our products and early dialogue with our customers and suppliers. 


1.3 We are taking the Year 2000 problem seriously within our own company. We have a company-wide 
programme dealing with the compliance of products we sell, the readiness of our internal business systems, 
the readiness of all building services under our control ie we are taking our own medicine. 


1.4 In addition to the ongoing discussions with our customers and partners, we have worked actively with 
the DTI, CSSA, BSI and other relevant organisations to raise awareness and provide best practice advice and 
guidance. We are major sponsors of Taskforce 2000 and its successor Action 2000, providing both financial 
and consultative support. 


2. SUMMARY 


2.1 The Year 2000 problem is a threat to the future economic performance and international 
competitiveness of the UK. In our evidence to the Committee we will concentrate on analysis and proposals 
for a few key issues, which we consider, need urgent attention to address this threat: 


—  theneed for active and public monitoring mechanisms to ensure the readiness of all key Government 
and infrastructure services; 


— the potential role of Government as an exemplar of best practice; 
— non-competitive self-help groups; 


— the need for extensive help for SMEs who look like being the weak links in the economic supply 
chains; 


— Government role in achieving global compliance; and 
— a growing shortage of staff with appropriate IT skills. 


3. PUBLIC MONITORING 


3.1 The timescales for solying the Year 2000 problem are embedded in existing business systems and 
cannot be slipped. It is imperative for maintaining public confidence that any risk of key Government and 
infrastructure services not being ready in time should be identified and acted on as soon as possible. Public 
scrutiny is a powerful mechanism to achieve this. 
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3.2 The United States House of Representatives’ Subcommittee on Technology of the Committee on 
Science and the Subcommittee on Government Management, Information and Technology of the Committee 
of Government Reform and Oversight have established such a public scrutiny mechanism administered by 
the Office of Management and Budget. 


3.3 All US Government agencies are required to submit a quarterly report of quantified progress against 
a Government template of key readiness milestones and timescales (see Appendix A for details).* These 
reports are published on a US Government public website along with analysis and recommended actions. The 
actions are designed to recover slippages but there are also sanctions for poor performance eg withholding of 
budgets for other IT projects. 


3.4 We recommend that Her Majesty’s Government introduce such a scheme covering all Government 
departments and agencies. Furthermore, the Official Regulators should be instructed to apply a similar 
scheme to privatised utility and transport industries. This monitoring should be extended to cover the 
existence of practical contingency plans with appropriate triggers. 


3.5 Government regulatory bodies responsible for licensing or certifying activities or processes should be 
instructed that future renewals should take account of Year 2000. Applications should be subject to 
documented proof of a Year 2000 plan identifying and addressing prioritised risks. 


3.6 ICL would be willing to help in defining appropriate milestones, timescales and measures. 


3.7 The spotlight of public scrutiny must be applied to both the private sector and the public sector. The 
possibility of legislation/regulation to force companies to disclose their Year 2000 readiness plans should be 
considered. The US Securities and Exchange Commission has pioneered this approach by issuing guidelines 
covering the conditions where information concerning Year 2000 issues must be disclosed in documents filed 
with that Commission. 


4. GOVERNMENT AS AN EXEMPLAR OF BEST PRACTICE 


4.1 There is a wealth of knowledge and experience amongst the various Government 
departments’/agencies’ Year 2000 Programmes. We suggest that a Government agency which is well 
advanced with its Year 2000 activities should be asked to act as a focal point to work with other agencies to 
identify and share best practice, information, and advice and guidance, in effect to become the benchmark 
for dealing with this issue. 


4.2 This information should be made freely available at least via a Government public website for the 
benefit of all Government agencies and the whole community. Particularly useful would be information 
about: 


— testing; 


— rules for representation of dates in the electronic interfaces used by the various Government 
agencies to interwork with their many customers; 


— embedded systems in buildings; and 
— compliance status of Commercial Off the Shelf software particularly for desktop computing. 


4.3 The Buying Agency should develop and publish the Government policy on procurement and awarding 
of tenders to ensure the Year 2000 compliance of all future product or service acquisitions. This procurement 
policy should be backed up by legislation/regulation along the lines of this year’s US Treasury, Postal 
Appropriations bill which prohibits Federal Government from purchasing any Information Technology 
which is not Year 2000 compliant. 


4.4 The Health and Safety Executive should ensure that each of its Divisions and Directorates researches 
and publishes advice and guidance on identifying and dealing with potential health and safety issues arising 
from the Year 2000 problem. 


4.5 Every Government organisation should be required to review whether the Year 2000 problem could 
affect anything, which falls within its terms of reference. The results of these reviews should be turned into 
action plans for lobbying and mobilising all stakeholders in the relevant field to address the issues. 


5. NON-COMPETITIVE SELF-HELP GROUPS 


5.1 The Government should use its various contacts and regulatory influence to encourage all sectors, both 
industrial and non-industrial, to view the Year 2000 problem as a non-competitive survival issue and to form 
sector specific self-help groups to gather and exchange knowledge. This is happening very effectively in the 
United States, especially in the energy industries where there is an underlying safety imperative. 


5.2 Such self-help groups would be particularly beneficial for those industries, which are dependent on 
embedded systems for plant and process control. They have particular difficulties because they are faced with 
a huge problem and very little expertise or knowledge to analyse and solve it. 


3 Not printed. 
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6. SME READINESS IS CRUCIAL 


6.1 There is growing recognition amongst large enterprises—that may have the skills and resources to 
tackle their own problems—that their business may still be at risk if their supply chain partners fail. 


6.2 This is particularly true for enterprises which do not hold much stock but depend on “just in time” 
deliveries of goods or components. Many of these suppliers are SMEs who are struggling to come to terms 
with the Year 2000 problem. 


6.3 One of the key themes of the new Action 2000 initiative covers SMEs and the provision of information 
and resources to help them. Examples are: 


— technical help desk; 
— information services covering: 
— _ suppliers and product status; 
— tools and methods; and 
— service providers. 
— _ best practice guides; 
— action checklists; 
— information on tools and methods; and 
— regionally based seminars and training courses. 


This is a crucial set of activities which must be allocated realistic resources, both staff and funding, in order 
to succeed. 


6.4 There is an abundance of information about the Year 2000 problem on the World Wide Web. However 
most SMEs either do not have World Wide Web access or, when they do, they do not have the staff with the 
skills or availability to find it and turn it into something useful for them. Support for SMEs should include 
a knowledge brokering service. This would track publicly available information on all aspects of the Year 
2000 problems and solutions and synthesise it into a form suitable for SMEs. This should include making it 
available in formats (eg paper, CD-ROMs) suitable for SMEs with no access to the World Wide Web. 


6.5 The DTI in particular has been very active in recent years in trying to encourage and promote the 
growth and effectiveness of SMEs. All the contact information and communications channels generated by 
these activities should be used to actively disseminate free help to them. 


6.6 Information is the key to minimising the risks of problems due to the Year 2000 problem. The 
Government could address the needs of both SMEs and the general public by providing a Year 2000 National 
Helpline to provide advice and guidance. 


7. GOVERNMENT ROLE IN ACHIEVING GLOBAL COMPLIANCE 


7.1 As demonstrated by recent stock market events in the Far East there is a strong linkage between the 
economies of all the countries in the world. In the same way that large enterprises are taking action to ensure 
the compliance of their suppliers, the Government should be acting to ensure that our trading partners are 
doing everything possible to achieve compliance. 


7.2 The United Nations Working Group on Informatics, chaired by Ambassador Ahmad Kamal, the 
Representative for Pakistan, is mounting an active campaign to help those countries that do not have 
adequate technical expertise or resources to remedy problems themselves. The Government should provide 
all possible support for this activity. 


7.3 All regulatory bodies should be contacted and urged to establish contact with their overseas 
counterparts to exchange knowledge and experience of achieving effective compliance and contingency 
planning within their sector. 


7.4 The European Commission’s Directorate General III (Industry) is leading activities to determine what 
actions the Commission should be taking. We recommend strong UK Government support for these 
activities. 


8. IT SKILLS SHORTAGE 


8.1 A recent millennium skills shortage conference organised by the DTI concluded that the growing 
shortage of staff with IT skills would increasingly affect Year 2000 activities. It is already causing 
organisations to pay inflated rates to retain and acquire staff with appropriate skills for their Year 2000 
programmes. The bulk of spending on Year 2000 activities will occur in 1998 and 1999 and this is when the 


skill shortage will have the most negative impact. The introduction of the Euro in 1999 will exacerbate the 
situation. , 


8.2 Skill shortage is one of the main themes of Action 2000 and we recommend that it should be adequately 
funded to implement the actions proposed by the DTI conference. 
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8.3 An important aspect of dealing with the skill shortage is matching any available people with relevant 
skills to the organisations in need of them. The Government could consider providing a central directory 
service to support this. 


9. ANSWERS TO THE FOUR SPECIFIC QUESTIONS IN THE SUBMISSION INVITATION 


9.1 ICL regards the Year 2000 problem as a serious business risk to the extent that it has appointed a 
Director to lead a company-wide Programme to address it. 


9.2 All new and enhanced product releases produced by ICL are now “millennium compliant”. The only, 
few, exceptions are where we have consulted with our customers and agreed with them that availability of 
other new product features should have higher immediate priority. We have a company-wide supplier 
engagement programme to determine the Year 2000 readiness status of all products which we use in delivered 
solutions and services. 


9.3 All constituent businesses have been mandated to produce a plan with uniform milestones and 
timescales to ensure the Year 2000 readiness of their IT systems. We have worked closely with our External 
Auditors to ensure that these plans are independently audited for completeness. 


9.4 We think that the Government, through Taskforce 2000 and the efforts of the CCTA, has been at the 
forefront of efforts to raise awareness. However, as has been recognised with Action 2000, there is much more 
to be done in encouraging/helping/ensuring that enterprises take all actions necessary to remove the risks to 
their business. This memorandum has identified some of the further actions we think are necessary. 


November 1997 


APPENDIX 16 
Memorandum submitted by the British Broadcasting Corporation (“The Corporation”) 


INTRODUCTION 


1. The Corporation has been asked by the Science and Technology Committee to respond to its inquiry 
concerning “the extent and nature of the problems likely to arise from the inability . . . to manage correctly 
the date change from 1999 to 2000. ..”. 


2. The relevance of the Corporation to this inquiry is that it: 


— provides television and radio services relied upon by the UK public; it will be providing coverage 
of the millennium commemorations and events to the UK, and through the World Service, to an 
audience of nearly 150m; 


— isa major public service institution bridging both public and private sectors; 


— has universal public visibility, operating on a truly international scale in a highly competitive 
environment; 


— has already transmitted programmes about the Year 2000 problem; and 


— isactively operating a Corporation-wide Year 2000 project utilising a multi-sourced workforce with 
experts from the Corporation itself, major consultancies and contracting agencies and other 
suppliers. The project is directed by a senior Corporation operations manager and represented on 
the Executive Committee by the Director of Finance and Information Technology. 


SUMMARY 


3. The main points made in this paper are: 


— the Corporation’s absolute priority has been the formulation of plans to ensure that BBC 
programmes, domestically and through the World Service remain on screen and on air over the 
millennium date change and to achieve these plans in the most cost effective manner; 


— the Corporation’s senior management is aware of both the serious potential impact of the 
millennium date change and the Corporation’s dependence on computer and chip based systems. 
These systems and processes extend across information technology, broadcasting technology, 
property systems, office and business systems and relationships with suppliers/customers. The 
Corporation recognises its public duty to continue to provide its trusted television and radio services 
at their current high level of quality before, during and after the millennium and to ensure the health 
and safety of staff and contributors alike; 


— _ while confident that the work necessary to broadcast and produce programmes will be done in time, 
several constraints exist. These include a shortage of information technology skills, suppliers’ 
reluctance to provide guarantees of compliance and a difficulty in distinguishing valid concerns or 
risks amongst a mass of conflicting information; 
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— the Government, through Task Force 2000, and subsequently Action 2000, has been raising 
awareness of millennium issues. The BBC is concerned that sufficient assistance reaches all areas of 
the broadcast sector. 


EVIDENCE 


4. Answers to the specific questions asked are provided below: 


Ql. What estimation has your organisation made of the seriousness of the “millennium bug” problem to your 
organisation? 


The Corporation is now heavily dependent on computer and chip based systems. The Year 2000 problem 
is, potentially, an extremely serious issue. The primary focus is the maintenance of television and radio 
broadcasting services to the public. 


In the Summer of 1996 the Corporation began investigating the extent of the “millennium bug” issue. In 
October 1996, it established a millennium project working with its external auditors KPMG to scope both 
the risks and strategy options to remedy the millennium problem. In June 1997 the Executive Committee 
approved a full “millennium proofing”, project led by a Project Director, with three major project strands 
covering broadcasting systems, financial and business information systems and property systems. The 
Corporation has also fulfilled its public service role by aiming to provide support in the education of the 
public concerning the millennium problem through several television and radio broadcasts covering the topic. 


Q2. What steps have been taken, and when, to avert problems in computer systems and software at the 
millennium? How much work remains to be done to ensure a smooth transition from 1999 to 2000? How confident 
is your organisation that it will encounter no problems at the millennium resulting from the inability of computer 
systems to handle the date change? 


Through the use of “millennium assessors” across the Corporation, the project has undertaken a business 
priority assessment to identify the systems that are “mission critical” and decide which need to be fixed first. 
Initial focus will be on broadcast related systems. 


Current work is concerned with assessing problems with key systems and generating solutions, developing 
contacts with suppliers of goods and services to the Corporation and undertaking a major management and 
staff communications exercise. 


Future work will include monitoring the progress of specific implementation projects, testing fixes and 
systems interfaces, preparing and implementing a roll-out plan and establishing a contingency plan to back- 
up critical systems. 


Plans will be continually revised in the light of experience as remedial action progresses. The Corporation 
is confident that the work necessary to ensure the ability to continue broadcasting and produce programmes 
will be done in time for the millennium. It is inevitable that there will remain a small number of systems where 
rectification or replacement work is necessary after the millennium date or where the initial work undertaken 
subsequently proves to be ineffective. 


It is Corporation policy that contracts for new systems/software specifically require millennium 
compliance. Appropriate guarantees for existing contracts are also sought, but this is proving difficult to 
achieve in some areas, eg power utilities. 


Q3. What, if any, are the major constraints on your organisation which may hinder work on averting computer 
system and software failures at the millennium? 


Three constraints may hinder work on compliance: 
— the increasing competition for skilled information technology resources; 


— direct contact with the Corporation’s suppliers has frequently resulted only in confirmation that 
“best endeavours” are being made to overcome the problem, but without providing any 
commitment or guarantee of a successful outcome; 


—  thelegal implications of potential disputes are emerging as a major potential issue, as the likely costs 
of compliance emerge, and the reluctance to provide guarantees by suppliers becomes evident. It is 
also clear that risk insurance against millennium compliance claims will not be available. 
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Q4. Has your organisation developed contingency plans should computer systems fail at the millennium? What 
would be the consequences of such a computer failure for your organisation? Whom would you hold to be 
responsible? 


The existence of the Year 2000 project, together with the Corporation’s current arrangements for ensuring 
that broadcasting continues during emergencies, mean that a strategy exists for the development of 
contingency plans. These plans will be refined during 1998-99, once it is clear which systems have not been 
made compliant but nevertheless remain critical to the Corporation’s broadcasting, efficient management and 
staff health and safety. 


As Project Sponsor, The Director of Finance and Information Technology is ultimately responsible for 
the project. 


Q5. Do you think that the Government has done enough to raise awareness of the potential problems that may 
be caused by the millennium bug? Has it done enough to help find solutions to the problem? What more should 
be done? 


Reports of Government action have been made available to the Corporation through press statements and 
presentations from Task Force 2000 representatives. 


Members of the Corporation’s project team have attended conferences where Government representatives 
have given, and received, presentations. 


The Corporation has yet to receive any Government literature from Action 2000. 


Organisations such as the British Standards Institute (BSI) and the Central Computer and 
Telecommunications Agency (CCTA) have produced relevant material to assist action planning. 


Government activity has helped encourage widespread public understanding that an issue exists. 
Government assistance in finding more general solutions to the millennium problem, and in co-ordinating 
information about best practice, implementation processes, activities and achievements is essential. 


RECOMMENDATIONS 


5. The Corporation would recommend to the Government that it: 


— assist in co-ordinating and sharing information and, specifically, in finding solutions to the problem, 
which may already have been developed within major public or private sector organisations; 


— consider what legislative steps could be taken to require that all suppliers provide millennium 
compliant goods and services without this needing to be explicitly written into every contract; 


— publicise the initiatives underway within Government departments; and 
— consider the consequences of the current EMU timescales on millennium work. 


2 December 1997 


APPENDIX 17 
Memorandum submitted by Ian Simister, Co-ordinator, Lloyd’s Year 2000 Programme 


1. INTRODUCTION 


1.1 Lloyd’s is a market in which more than £7 billion of insurance business is transacted each year by 
multiple firms of underwriters and brokers. Business is conducted using both paper and electronic processes 
which, typically, give rise to 2.5 million policy transactions and 22 million output transactions in any one year. 
The Corporation of Lloyd’s which processes these transactions centrally on behalf of the market holds 
approximately 750 gigabytes of data in its operational databases, all of which are to some degree date related. 
The interdependence of the market firms trading at Lloyd’s potentially increases their exposure to the effects 
of the year 2000 problem. 


1.2 Summary 


Lloyd’s Market Board has established a Year 2000 Programme for the Lloyd’s Community. Consensus 
has been reached that compliance should be demonstrated by the end of 1998. Most firms are on schedule. 


A small number of firms within our own community indicate little, current intention of devoting 
management attention to the problem. 


Businesses, generally, suffering financial or other losses will seek to blame others or seek to claim from 
insurers. It is easy to envisage unprecedented levels of claims emerging. 


Lloyd’s central systems are relatively new and will require less significant modification than might 
commonly be anticipated for large mainframe systems. 
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Introduction of the Euro could not have happened at a worse time. Lloyd’s will allow for the settlement 
of transactions in Euro. Any further commitment could not, realistically, be undertaken prior to 2000. 


The increasing use of our regulatory framework is anticipated during 1998. 


The role played by Taskforce 2000 has been highly commendable. The meagre funding of the organisation 
allowed it to do little more than repeat the call-to-arms. 


Government’s response in no way matches the commitment now being made by the business community. 


There is a clear cost argument for a central register holding the status of compliance of such businesses as 
the major utilities and transport providers. 


The establishment of a year 2000 “reporting environment” built around agreed criteria would provide 
significant benefits. 


2. NATURE OF THE PROBLEM 


2.1 That some computer systems will not perform in a predictable way after 31 December 1999 and the 
consequent requirement to effect corrective action appear now to be accepted, universally as fact. That the 
implications go far beyond this straightforward technological dimension and that severe business dislocation 
could result seem far from widely accepted, even within the business community. A small number of firms 
within our own community display such lack of understanding and indicate little, current intention of 
devoting management attention to the problem beyond accepting any cost implications of changes made by 
their third party software suppliers. 


2.2 These isolated situations will be resolved within the framework Lloyd’s has established to achieve 
market wide compliance but are indicative of a far wider problem with significant potential to generate claims 
on insurers and to damage the trading position of underwriters. Businesses, generally, suffering financial or 
other losses will seek to blame others or seek to claim from insurers. It is easy to envisage unprecedented levels 
of claims emerging in areas such as the liability of directors and officers, professional negligence, product 
guarantee, legal expenses and that almost all insurance policies will be affected to some degree. 


2.3 The litigation associated with severe business loss, disruption or demise will be substantial as those 
involved seek to apportion blame, to recover their losses, to protect professional and product credibility and 
to challenge the validity of claims made. Jeff Jinnett of US lawyers LeBoeuf, Lamb, Greene & MacRae 
postulates a potential $3 trillion of litigation, world-wide, consequential to year 2000 problems. 


2. ACTION TAKEN BY LLOYDS 


3.1 In April of this year, following 12 months of technical investigation, Lloyd’s Market Board launched 
a Year 2000 Programme for the Lloyd’s Community and established a Programme Office to: 


Co-ordinate activity across the Community 

Provide guidance on best practice 

Provide information and support 

Provide a central research facility 

Establish and monitor Lloyd’s collective position on compliance 
Provide regular progress reports to the Board 


3.2 All Lloyd’s Managing Agents (underwriting firms) have completed self-assessments based on a 
standard methodology which establishes and measures progress against seven major milestones towards 
compliance. The programme has recently been extended to include Lloyd’s brokers. 


3.3. Consensus has been reached that compliance should be demonstrated across the Community by the 
end of 1998 in order to provide a year end opportunity to test systems prior to 1999 and to minimise the 
possibility of incorrect processing and postings to 2000 accounts during 1999. It is also considered prudent 
to allow a full year for the determination of remaining risk exposure and the development of appropriate 
contingency arrangements. A high level timetable has been adopted which reflects these intentions. 


3.4 Full testing of business procedures involving all market firms and central service providers is a key 
element of the plan. Six months has been allowed for this activity which will be centrally co-ordinated within 
an agreed strategy. Compliant test environments are in place for the testing of central systems and of 
electronic messaging between trading partners. Test environments for more local applications will be made 
available in early 1998. A technical assessment of personal computers in use has indicated the need to upgrade 
or replace some 75 per cent of the current hardware stock, to change the operating system in approximately 
50 per cent of cases and to move all users to a new version of desktop software in readiness for the year 2000. 
The change in desktop software will add an organisation-wide training element to the year 2000 overhead. 


25 As the result of a major commitment to IT development in the 1993 business plan, the majority of 
Lloyd’s central computer systems have been rewritten within the last five years and incorporate four digit 
fields to designate the year. Our current assumption is, therefore, that these applications will require less 
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significant modification than might commonly be anticipated for large mainframe systems. A schedule of tests 
to validate this assumption is in place and the early results have been extremely positive. 


3.6 The Programme Office liaises regularly with the EMU team, which has a separate reporting line, to 
ensure that the inevitable conflict for IT resources is identified at, and managed from, an early stage. From 
this perspective the introduction of the Euro could not have happened at a worse time and whilst Lloyd’s will 
manage resources to amend systems which will allow for the settlement of transactions in Euro, we are 
convinced that any further commitment requiring more extensive systems changes could not, realistically, be 
undertaken prior to 2000. 


3.7 Lloyd’s Regulatory Division have been concerned for some time that the year 2000 problems could 
constitute a threat to firms’ long-term viability and, therefore, look for the demonstration of a professional 
approach to year 2000 issues as an integral part of their review programme. The activities required to achieve 
compliance will become more precisely identifiable as the target date for its demonstration approaches. The 
Lloyd’s timetable requires that detailed plans for such activities should be in place by the end of 1997 if our 
end of 1998 target is to be achieved. The increasing use of the regulatory framework, and in particular the 
review process, is anticipated during 1998 with the requirements being formalised and extended to include 
the presentation of high level plans and an ongoing demonstration of progress against them. 


4. ROLE OF GOVERNMENT 


4.1 The role played by Taskforce 2000 has been highly commendable. Lloyd’s called upon the services of 
its Executive Director to present the context of the year 2000 problem and the implications of inactivity on 
two occasions; on launching its own programme and at a professional indemnity conference for US insurance 
agents. The meagre funding of the organisation allowed it to do little more than repeat the call-to-arms. 
Organisations responding or already committed to action were thus left to spearhead their approach 
individually or possibly in conjunction with trade associations. Little impact has so far been seen from the 
creation of Action 2000 and although the intended direction appears to be appropriate and the indicated 
budget represents a move in the right direction, the level of the Government’s response in no way matches 
the commitment now being made by the business community. 


4.2 The Committee will, I am sure, examine elements of existing, and in particular advanced, programmes 
which could provide models for future Government action. Aspects which, almost certainly, will emerge for 
further consideration are: 


Leadership 
Collective action to reduce cost 
The requirement for information and legislation 


4.3 Leadership is vital both for the tardy and for the advanced. Models of best practice, from start-up to 
demonstration of compliance, should therefore be adopted and widely publicised. Given the commercial and 
competitive pressures affecting the response of businesses to this issue, it is also important that Government 
understands the constraints to the free flow of information which exist and seeks to establish appropriate 
channels for more open and concerted action. 


4.4 The high cost of year 2000 activity, much of which will be found at the expense of strategic 
development, is of concern to all. A considerable proportion of this expenditure stems from the investigation 
of issues common to many. Within most local programmes some form of central investigative role is created 
to minimise the duplication of effort and thus the cost. Direct parallels exist on a national scale with every 
person and organisation in the country having an interest in, if not a need to investigate, the status of 
compliance of such businesses as the major utilities and providers of public transport. There is a clear cost 
argument for a central body or register to be created to make available such information and a secondary 
argument for preventing such organisations being inundated with information demands. 


4.5 The establishment of any co-ordinating or reporting body for year 2000 raises issues of certification 
and, therefore, the potential for litigation in the event of loss or disruption. This is a considerable disincentive 
to trade associations and professional bodies who might be contemplating moves in this direction. It seems 
already to have created near paranoia in the minds of some auditors and major systems suppliers. As 2000 
approaches the situation will worsen and, in some situations, will positively prevent the flow of necessary 
information. The exploration and establishment of a year 2000 “reporting environment”, possibly built 
around criteria agreed with the appropriate professional bodies, could only be contemplated by Government 
and should be, given the significance of the benefits which would accrue. 


4.6 The formalisation of such a framework could also assist the Government in considering the 
appropriateness of legislation in respect of year 2000. Without such a framework in place it is difficult to 
envisage quite what could be mandated which would assist in achieving compliance and in avoiding economic 
damage. The alternatives may well make it easier to apportion blame sometime in the new millennium but 
will do little to help us get there. 


2 December 1997 
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APPENDIX 18 


Memorandum submitted by the Equipment Management Special Interest Group, the Institute of Physics and 
Engineering in Medicine (IPEM) 


The Institute of Physics and Engineering in Medicine (IPEM) has received a copy of the press notice 
regarding the forthcoming inquiry into the Year 2000 and Computer Compliance. IPEM would like to submit 
the following response to the committee. 


The effects of the Year 2000 on computer systems and medical equipment are of concern to many in the 
field of Medical Physics and Clinical Engineering in the NHS. IPEM represents many professionals in this 
field, and continues to monitor developments on the Year 2000 issue through its Scientific Committee and 
Special Interest Groups. 


IPEM continues also to inform its members about this issue through Newsletters and the IPEM Web site 
(www.ipem.org.uk). 


In many Trusts, IPEM members are on local committees dealing with the Year 2000 issue, and they will 
need to know the effects on software and equipment. Hence there is a need for centrally provided information 
in order to avoid unnecessary duplication of effort. Use of the IPEM Web site and those provided by the NHS 
Executive Information Management Group and Scottish Healthcare Supplies assists this process. 


To date, there has been little published information on Year 2000 compliance of specific equipment and 
hence many IPEM members are contacting Manufacturers and Suppliers to establish the status of items for 
which they have responsibility. 


A great deal of duplication of effort will result from this, which our members have stressed is a waste of 
limited NHS resources. It was expected that a central source, possibly the World Wide Web space (WWW) 
held by the Medical Devices Agency (MDA), could be used to indicate where confirmation of compliance 
had been obtained by the MDA or by user organisations. The matter of contingency planning has not been 
covered in the MDA’s device bulletin DB9704 published on the WWW. We hope guidance on this matter will 
be provided in the not too distant future. 


This information will enable informed decisions on required actions and contingency plans to be made. 


I December 1997 


APPENDIX 19 
Memorandum submitted by Thames Water plc 


1. INTRODUCTION 


Thames Water supplies water and waste water services within the Thames Valley area. We are a major 
utility company supplying essential services to London. Any failure of our services for a significant period of 
time would have a potentially serious impact on the public health of millions of people. 


The company recognised the Year 2000 problem more than two years ago and established a projects 
programme at the beginning of 1996 to address the matter. 


2. ASSESSMENT AND ESTIMATION 


The company has investigated the issue, segmenting its effort into the following complementary areas: 
— Corporate IT systems 
— Laboratory systems and instruments 
— Operational monitoring and control systems 
— Building services 
— Telecommunications 


2.1 The problems that existed in corporate IT systems were considered to be serious and likely to impact 
the commercial operations of the company. 


2.2 Certain operational monitoring and control systems are critical to major water and waste water 
processes. A failure of embedded systems within operational control could have serious impacts on water and 
waste water services. 


2.3 A full assessment of laboratory systems has been completed. Reviews for telecommunications and 
building services are ongoing. 
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3. ACTIONS 


3.1 The company has established a programme of remedial work and replacements for its corporate IT 
systems. We are confident that all necessary changes will have been completed in time to avert detrimental 
consequences. The work programme is a well established on-going set of projects. 


3.2 Survey and replacement work for operational embedded systems is being undertaken. Priority is being 
given to critical and important processes. We face the same problems as all other industries in assessing the 
likelihood of failure of individual computer chips. 


3.3 Our laboratory systems will be fully compliant by the end of 1998. Current survey work of our building 
services is confirming our expectation of few if any significant problems to be addressed. We are working 
together with our telecommunications equipment suppliers to determine the risk to our internal network. 


4. CONSTRAINTS AND CONTINGENCY PLANS 


4.1 There are no perceived constraints to achieving compliance for our corporate IT systems. 


4.2 The constraint to achieving compliance with embedded systems is the vast number of process 
controllers we have installed across the region and the difficulty of assessing the risk of failure in individual 
cases. The low availability of suitably qualified ICA technicians is a constraint. 


4.3 The slowness of telecommunications equipment suppliers to come to terms with potential problems is 
considered by us to be a constraint. 


4.4 We have contingency plans to cover many areas of risk and are in the process of developing them for 
major operational processes, where we consider that the resolution of the embedded problem may be in doubt 
and the water/waste water process is critical. 


5. OTHER 


5.1 A major failure in our corporate IT systems could have a commercial impact and would be potentially 
embarrassing, for example if bills showed incorrect dates or were incorrectly calculated. We would expect to 
intercept any such problems within the organisation. In these circumstances, the impact of such a failure 
would be limited to an adverse effect on cash flow. 


5.2 Major failures of operational processes would affect water supplies or waste water treatment. We are 
confirming that manual overrides would provide adequate mechanisms for direct control in the event of 
continued outage of supervisory control systems. This forms part of our review of contingency arrangements. 


5.3 We do not expect, at this point in time, to take any legal action for past supply of non-compliant IT 
products. 


6. SUMMARY 


The problems that the company faces in respect to Year 2000 compliance problems are significant, but also 
quite within our capabilities to solve. 


We have an established programme of projects to achieve compliance. 


It will not be possible to eliminate all risks. The most likely ones remaining at the end of the millennium 
will be with respect to operational embedded systems for process control. Apart from direct remedial actions, 
we are also making contingency arrangements to maintain process control where the impact of failure 
warrants that provision. 


APPENDIX 20 
Memorandum submitted by J Sainsbury plc 


1. INTRODUCTION 


1.1 J Sainsbury plc is one of the top 10 users of computer systems in the UK. 


1.2 The principal operating companies are Sainsburys Supermarkets Ltd, Savacentre Ltd, and Homebase 
Ltd. Our main business is food retail and DIY. 


1.3 Computers are pervasive throughout the business. Key applications include the checkout, the supply 
chain, food safety, electronic banking, electronic data interchange of orders and invoices with suppliers, 
payroll, accounting and management information. 
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2. How SERIOUS IS THE MILLENNIUM BUG? 


2.1 If not contained, the Millennium Bug would certainly have a major impact on our business. Clearly, 
we are not going to allow this to happen. 


2.2 The problem is not simply the transition from 1999 to 2000. For example, thanks to preventative 
action, our stores are already handling goods with Best Before dates in the next century, and payment cards 
which expire after the Millennium. We anticipate a steady build up of further “date events” in our systems, 
peaking sharply at the Millennium itself, but then dropping off gradually for up to three years thereafter. One 
of these events is the processing of information relating to the year 1999, which is not handled correctly by 
a few of our systems. 


2.3 The consequences of serious computer failure would be unthinkable. We have no intention of allowing 
this to happen. For example, 


2.3.1 Extended failure of our checkouts would force us to close our food stores to the public for an 
indeterminate period. We have literally no alternative means of trading, because goods are no longer 
price-marked. 


2.3.2 The supply of food would be disrupted. Both our internal distribution network, and our suppliers, 
depend on highly automated systems. We no longer employ sufficient staff to work around a system failure 
for more than a day or two. 


2.3.3 Failure of automated refrigeration monitors would prevent the sale of chilled and frozen food. 


2.3.4 We are dependent on the continued provision of essential services, such as power, public transport 
and telecommunications. 


2.4 In principle, we have contingency plans to work around any failure of our banking, payments, payroll 
and accounting systems. However, no responsible business could seriously entertain the possibility of 
allowing this to occur on a widespread basis. 


3. WHAT STEPS HAVE BEEN TAKEN? 


3.1 A programme has been established in every Operating Company, under the overall governance of a 
Board director, at an estimated cost of £40 million. 


3.2 Suppliers of computer hardware and software have provided us with a plan of action. We are testing 
their solutions as they are delivered. 


3.3 We have already converted 30 per cent of our own computer programs, using a large team of IT staff 
in the UK and India. Equipment incorporating embedded chips will also be tested. This programme will be 
completed in 1998. 


3.4 We have written to every supplier of goods, services and equipment, to understand their plans. At this 
stage, we are concerned that the majority of companies have failed to reassure us. 


3.5 We are confident that this action will reduce the problem to manageable proportions, at least as far 
as our internal systems are concerned. We cannot be absolutely certain that there will be no problems—tt is 
mathematically impossible to test all the scenarios that could arise in theory—but major disruption is very 
unlikely. 


4. CONSTRAINTS 


There are no major constraints on our ability to contain the problem internally. Retention of IT staff in a 
very competitive labour market, and ensuring delivery of all the component solutions from our IT suppliers, 
will be a management challenge, but we remain confident. 


5. CONTINGENCY PLANS 


Contingency plans are in place for all mission critical operations. However, these are under review, as the 
Year 2000 scenario is subtly different from those previously considered. As explained in 2.3, our contingency 


plans do not allow us to operate for an extended period without systems, so the main emphasis is on 
prevention. 


26 November 1997 
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APPENDIX 21 
Memorandum submitted by the Institution of Electrical Engineers (IEE) 


INTRODUCTION 


1. The Institution of Electrical Engineers is the largest professional engineering society in Europe, with 
nearly 140,000 members. The activities of the Institution cover electrical and electronic technology, 
communications, manufacturing, computers, systems and software engineering. Many of our members are 
involved in the use and application of computers in industry, and they are therefore very much concerned 
with dealing with the Year 2000 problem. 


SUMMARY 


2. The problem caused by the inability of some computers to recognise the change of date from 1999 to 
2000 (the Year 2000 problem) could, if not solved, cause severe difficulties to many branches of industry, 
commerce and society at large. The IEE has taken steps, not only to ensure that its own internal systems will 
be unaffected at the turn of the century, but to provide help and guidance to the outside world, taking 
advantage of the wealth of experience and expertise represented by its members. The Institution has co- 
operated with many other bodies including Government, and we have developed an understanding of the 
problems and their potential solution. We attempt in the following paragraphs to reflect our views in relation 
to the questions posed by this inquiry. 


THE SCALE OF THE PROBLEM 


3. There is no doubt that the scale of the problem could be substantial, if no action were taken. There could 
be major implications for commerce, industry, telecommunications, transport, energy and in fact almost 
every aspect of civilised society. Computers are now ubiquitous, and therefore in principle any operation 
which relies on a computer or any embedded microprocessor, which has a date-based function, could be 
vulnerable. 


4. There has been much “hype” and scare-mongering in the popular press, and the consequences of failure 
to deal with the problems have been exaggerated. This is not to say that we should be complacent. Many 
of the larger organisations in industry and commerce have recognised the problems and have taken steps to 
overcome them. Many smaller companies and organisations lack either the understanding or the resources 
to deal with the problem, and failure to take action could have serious implications. What is important is to 
ensure maximum awareness, so that sensible decisions and actions can be taken, based on rational, 
commercial and technical judgement. 


THE EFFECTIVENESS OF ACTION TAKEN SO FAR 


5. Action already taken by many large corporations to avert problems in their own activities is probably 
adequate. In the case of Government, we have insufficient evidence to determine whether or not they have 
taken adequate steps. Major organisations have both the expertise and the funding necessary to assess the 
problem, identify a solution and implement it. It may for example be sensible to replace suspect hardware with 
equipment guaranteed to be reliable. This however does not necessarily obviate the need to check, modify and 
test software. This will involve an immediate capital expense, but computers in any case have a relatively short 
write-off period, and on commercial as well as technical grounds, early replacement might be seen as the 
best option. 


6. Smaller companies are in a more difficult position. They may fail to appreciate their vulnerability, their 
financial position may be weak, and they are more likely to lack the expertise necessary to identify and solve 
any problems. Furthermore, in the case of embedded software, they may not even be aware that such software 
exists within their operations. It is especially to this sector of industry and commerce that particular and 
urgent attention needs to be paid. 


THE ROLE OF GOVERNMENT 


7. Government clearly has an important part to play in alerting the country to the potential problems, and 
to seeking solutions. As ever in any awareness activity, the difficulty is to strike a balance between 
sensationalism and complacency. An awareness programme needs to be based on rational and persuasiveness 
argument, backed up by sound technical information. The Government has direct access to all the necessary 
information, and understandably advice has been sought from a number of expert and informed bodies 
including the IEE. 


8. It might be argued that the remit of the original Task Force 2000 was never adequately clarified, and as 
a result, some of the statements issued by the Task Force appeared to reflect this uncertainty. Furthermore, 
the level of funding made available probably did not fully reflect the magnitude of the task, particularly in 
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the early stages. The sudden replacement of Task Force 2000 by Action 2000 did little to clarify the position, 
and continuing uncertainty over the latter’s role and level of resource, and its apparent lack of activity weaken 
what should be an important and high-profile function. 


THE EXTENT TO WHICH NEW SYSTEMS ARE “MILLENNIUM COMPLIANT” 


9. Very few systems are completely new, and designers must ensure that no part of the system will continue 
to cause problems. We understand for example, that only very few suppliers of personal computers are 
currently willing to guarantee absolute compliance of their equipment. It is likely that this situation will 
improve with time. To an extent, pressure will come from the customer in refusing to sign a contract without 
a compliance clause, and in having legal redress in the event of failure. 


THE DEVELOPMENT OF CONTINGENCY PLANS IN THE EVENT OF FAILURE 


10. Organisations which have identified a problem and sought and implemented solutions, are not 
anticipating failure, although contingency planning in the event of failure should nevertheless be undertaken. 
Clearly those organisations which do not appreciate the potential difficulties for whatever reason will take 
no action, and be vulnerable as a result. 


11. It would seem sensible for Government, both nationally and locally, to make contingency plans in case 
there is a disruption of vital services. Such planning should incorporate an audit of actions already taken by 
the military, police and fire services, the health service, telecommunications, energy and water providers, the 
banks and major food suppliers, so as to identify any obvious weaknesses and implement solutions well in 
advance. 


THE LEGAL IMPLICATIONS OF DISPUTES OVER LIABILITY FOR COMPLIANCE COSTS, AND SYSTEM AND PROGRAM 
FAILURES 


12. There is a growing consensus that the supply of non-compliant products is tantamount to providing 
goods which are not “fit for purpose”. It is clearly for the courts to rule on any particular circumstance. 
However, Government should emphasise that failure to disclose non-compliance could lead to claims for 
damages, on the basis that such non-disclosure constituted negligence on the part of the supplier. 


13. Companies will naturally be reluctant to guarantee compliance for equipment which has already been 
supplied, and it might be unreasonable to expect them to do so. However, they should at least co-operate with 
their customers in trying to identify problem areas and proposing appropriate solutions. In the case of new 
hardware and software, there is no reason why compliance should present any great difficulty. There will 
however be a potential problem if new, compliant equipment is installed in an existing system, part of which 
may be non-compliant. The supplier of the compliant equipment will wish to be indemnified for any problem 
arising through no fault of his own. Herein lies a legal minefield. 


ACTIONS TAKEN BY THE IEE IN RELATION TO ITS OWN SYSTEMS 


14. The IEE is a large professional institution employing 450 people. In addition to our institutional 
activities, we have an important commercial arm, publishing books and journals, organising conferences and 
providing an international scientific and technical data service. We appreciate the importance to our activities 
of overcoming the “millennium bug” problem, and have taken the problem very seriously. 


15. Work to identify necessary software changes to in-house programs has been undertaken. Amendments 
to programs will start in March 1998 to allow sufficient time for testing. In addition, letters are being sent to 
both software and hardware suppliers seeking confirmation of their readiness for the year 2000. Service 
providers are being asked to confirm in writing that their service will run uninterrupted, and where the service 
is critical to the business of the Institution, we are demanding that by the end of 1998, the service must be 
demonstrably Year 2000 compliant. We are confident that our own in-house programs will run without 


difficulty, although it is impossible to be completely confident about services, software and hardware supplied 
by others. 


16. Weare not aware of any constraints which may hinder work on averting computer system and software 
failures at the millennium. 


17. We have developed coritingency plans, should there be a computer failure. A short-term stoppage (say 
three to four days) would have little effect. Beyond this, we could suffer serious consequences. The 
responsibility for our computer systems and Year 2000 compliance rests with our Managing Director, 
Publishing and Information Services, and with our Director of Administration. 
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WHAT MORE CAN BE DONE? 


18. Much has already been achieved in raising awareness of the issues concerned with the Year 2000. 
Government has undertaken its own awareness activity, and encouraged others to do likewise. The press 
generally has promoted the issue, perhaps not surprisingly introducing a certain amount of hysteria. Many 
conferences and seminars have been organised, and articles have appeared regularly in the professional 
journals. Large organisations, including banks, energy companies, major airlines and manufacturers, have 
explored the issues and taken steps to avoid any serious consequences to their businesses. The emergency 
services, the armed services and food chains are all aware of the problems and are seeking solutions. 


19. It is not for Government to find answers to all the problems likely to be experienced by the multitude 
of organisations up and down the country. The problem is however international, and the Government is in a 
position to collaborate with our European and overseas partners, exchanging views and experiences, seeking 
solutions, and making them known to British business and commerce. 


THE ROLE OF THE IEE IN DISSEMINATING INFORMATION 


20. Asa professional organisation, the IEE has a responsibility to use its expertise, and that of its members 
and Industrial Affiliates, to help society at large in understanding and overcoming problems which are 
relevant to its activities. The Year 2000 problem falls very much within this category. Accordingly, we have 
been active in promoting an understanding of the issues, collaborating closely with others including the 
British Computer Society, the Health and Safety Executive, the Engineering Council, DTI, and a number of 
industrial companies. 


21. We have in particular concentrated on problems associated with embedded systems. A working party 
was set up, with expert representatives from industry and academia, and we have established a Web Site which 
is up-dated regularly and is being used extensively. A 160 page guidance document has been produced and 
circulated widely. In addition, members of the Institution have spoken at numerous seminars and meetings. 
We are planning to produce a short version of the guidance document aimed specifically at small companies. 


22. The IEE has access to a wide spectrum of advice and information through its membership, and 
contacts with other bodies. We would be happy to explore the possibility of taking on a “gate keeping” role, 
collaborating with others as appropriate, to provide a managed information service on behalf of Government 
for the benefit of society at large. 


2 December 1997 


APPENDIX 22 
Memorandum submitted by Greenwich Mean Time Ltd 


1. INTRODUCTION 


1.1 Greenwich Mean Time was formed by Karl W Feilder, an acknowledged year 2000 authority, as a 
private company to address the issues arising from Personal Computer year 2000 problems. 


1.2 The company has conducted extensive research into the problem as it affects PC software programs 
and PC hardware with the following findings: 


2. FINDINGS (REFER ANNEX A) 


2.1 47 per cent of PCs currently on sale may be described as non-compliant at the hardware level. 


2.2 64 per cent of PC software bought over the last five years (much of it currently in operational usage) 
contains identified year 2000 problems and issues. The remaining 36 per cent of PC software (much of it 
currently on sale) may, at best, be described as having insignificant year 2000 problems. 


3. CONCLUSIONS 


3.1 The majority of PCs in current usage, (estimated at 20 million in the UK) will experience some form 
of hardware and software disruption ranging from minor irritation to total loss of usefulness. Of these, 17 
million PCs are estimated to be in business use by both large and small organisations, and this will 
consequently have a major negative impact on the UK economy as we approach the end of the century. 


3.2 The year 2000 problem will start to affect PC users well before the end of 1999. Already this has become 
evident in programs such as inventory systems, accounts packages and programs that calculate forward 
projects such as mortgages and insurance policies. 


3.3 At best, only 6 per cent of these PCs have yet been correctly inspected for problems at the hardware 
level (refer Annex B). 
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3.4 The majority of organisations and government departments that have published statements on their 
year 2000 plans have failed to address the PC issue. Any year 2000 surveys or statistics that fail to include PC 
plans are likely to be very misleading. 


3.5 PCs pervade the business world to the extent that few organisations have precise information regarding 
the number, location or usage of their PCs, yet they are, in most cases, critical to the continued functioning 
of organisations. 


3.6 Many business computer users are aware of the year 2000 problem but do not understand how it affects 
them. They assume it is an IT problem and as such will be fixed by the industry. This is a wholly wrong 
assumption, and we respectfully suggest that a government funded media campaign be mounted to raise the 
understanding that this is a problem for every single computer user. : 


3.7 It is true that a significant number of organisations rely on their PCs to the extent that they cannot 
function without them. 


4. OTHER RELATED ISSUES 


4.1 PC software liability would seem to rest with the user of the software program, not with the 
manufacturer. This has yet to be tested in court. (The recent St. Albans vs ICL case was not relating to PC 
programs and may be held to be a very different matter.) 


4.2 PC hardware liability would seem to rest with the assembler and should be covered by the “fitness for 
purpose” condition under the Sale of Goods Act. This has yet to be tested in court. 


4.3 Britain is currently ahead of its largest European trading partners, Germany and France, and there 
seems no current mood by these partners to accept the seriousness of the situation. Britain has a unique 
opportunity here to demonstrate its European leadership. More importantly, the domino effect of the year 
2000 problem requires Britain not only to get its own house in order, but to prepare to withstand the impact 
of the inevitable economic failure of its traditional partners. 


4.4 It is impossible to modify PC hardware or software to achieve year 2000 survival concurrent with the 
adoption of the Euro. There is simply insufficient time and resource. 


5. OPINIONS 


Greenwich Mean Time is extremely concerned as to the ability of the UK to address the year 2000 problem. 
Specifically: 


5.1. The PC year 2000 problem is calculated to cost UK businesses £4.8 billion (refer Annex C i). 

5.2. A typical small company may be faced with a bill of over £21,000 (refer Annex C 11). 

5.3. No UK business has yet to complete its year 2000 task and the majority have yet to start. 

5.4. This problem is immense and threatens the stability of our country both economically and politically. 


5.5. It is nearly impossible to overstate the scale or impact of the year 2000 computer problem. 


6. CONSTRAINTS 


There are a number of factors preventing UK businesses from getting on with the job of checking every 
single PC for risks associated with the year 2000 problem. 


6.1. Incredulity at the severity of the problem. 

6.2. Understanding of the problem and its manifestations. 

6.3. Belief that “someone else will fix it”. 

6.4. Refusal to accept that the computer industry cannot and will not fix the problem. 


Greenwich Mean Time would welcome the opportunity to put these and other points in person, to the 
Committee, at the earliest possible convenience. 


1 December 1997 


Annex A 


Greenwich Mean Time hag investigated the year 2000 status of 4,000 best-selling PC software programs. 
Its findings show that of the 4,000 software programs checked, 2,568 (64.2 per cent) have some sort of year 
2000 date dependent behaviour which can create problems even as 2000 approaches. Of these, 724 (28.2 per 
cent) are claimed to be year 2000 compliant by their manufacturers. 
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Greenwich Mean Time has defined the year 2000 issues among the 2,568 programs as follows: 


— 629 (24.5 per cent) manipulate dates to perform date calculations. This can create problems where 
the dates being used are in a different century from the one which the program infers. 


— 539 (21 per cent) are programming development tools which are capable of creating programs that 
use dates incorrectly, so perpetuating non-compliance problems. 


— 506 (19.7 per cent) use a process known as “date windowing”. While at first glance such programs 
seem to be year 2000 compliant, there exists potential for indirect problems leading up to 2000, as 
the program must decide which dates belong in which century and it is often not apparent which 
century was chosen. Furthermore, these date “windows” differ from one program to another and 
the user has no way of changing them. 


— 295 (11.5 per cent) store dates differently from the way the user inputs them. These programs can 
work in 2000 but the user has no control over any function to do with date computations. 


— 254(9.9 per cent) have licensing issues which means that there is a time bomb embedded within them 
to counteract illicit use of the software. If the software manufacturer did not cater for either the year 
2000 or the year 1900, this time bomb may go off unexpectedly. 


— 142 (5.5 per cent) import dates from either the operating system or the BIOS, either of which may 
not register 2000 correctly. 


— 113(4.4 percent) do not recognise 2000 as a leap year (which it is), creating day-of-week errors from 
29 February 2000 onwards. 


— 90 (3.5 per cent) of shrink wrapped software programs that are commonly used today will only 
function in the 20th century. Users need to know which these are so they can abandon them in 
favour of programs that do work in 2000. 


As for PC hardware, Greenwich Mean Time found that 93 per cent of 1996 and pre-1996 BIOSs do not 
rollover successfully to 2000. For BIOSs created in 1997, the figure drops to 47 per cent which do not rollover 
successfully to 2000, a number which remains dangerously high at this late stage. 


(The BIOS initialises the PC, including setting up the system date and time by reading values from the real 
time clock chip which keeps a constant time reference for the PC. If the BIOS does not successfully rollover 
to 2000, all date and time references will be incorrect.) 


Annex B 


PC HARDWARE INSPECTION FIGURES 


The only way to correctly and accurately test a PC for hardware year 2000 problems is to use a tool, 
normally referred to as a “BIOS Checker’. These tools have been written by a number of commercial 
companies which, to date, have sold an estimated 3 million copies worldwide. 


Of these, it is further estimated that, at best, 1 million have been sold to UK customers. 


Thus, only | million of the estimated 17 million PCs in business use in the UK can have been properly and 
accurately checked for hardware year 2000 problems. 


Thus, at best, 6 per cent of business PCs in the UK have been correctly investigated. 


Worse still, of an estimated 350 million PCs in global business usage, less than | per cent have so far been 
correctly checked. 


Annex Cl 


Cost To THE UK ECONOMY—ASSUMPTIONS 


20 million PCs in current use—17 million in non-domestic situations. 
Cost to test a PC—£100. 

Cost to fix PC hardware—£10. 

Average cost to upgrade software—£300. 


Average cost to expand YY data to YYYY data (20 significant spreadsheets and one significant database 
per PC)—30 hours per PC at £50 per hour—£150 per PC. 


Assume 50 per cent of PCs are critical, the remainder to be destroyed. 
Total—£560 per PC. 
UK total—£4,760 million (rounded to £4.8 billion). 
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Annex C2 


A TYPICAL SMALL COMPANY 


Similar assumptions to previous, except: 
Assume 200 employees and 50 PCs 
Assume that 75 per cent of PCs are critical. 


Total company cost—£21,375 


APPENDIX 23 


Memorandum submitted by The Central Computer and Telecommunications Agency (CCTA) 


1. CCTA advises public sector organisations on the effective deployment of information technology in 
support of their businesses. In relation to the Year 2000 computer compliance issue we are running a 
programme of advice and guidance to help the public sector minimise the impact of century date change 
errors on their ability to provide public services. CCTA is working with the Central IT Unit (CITU) of the 
Office of Public Service who are funding much of this work programme and who are also charged with 
monitoring the progress of departments in addressing the problem. 


2. This submission outlines the main activities of the CCTA/CITU programme and includes a summary 
at Appendix A of CCTA’s own programme for addressing century date change problems with its own IT 
infrastructure. CCTA’s programme comprises four main streams of activity: production of guidance; 
dissemination of advice and information; co-ordination of public sector activity; progress monitoring. 


3. Advice and Guidance. Since the start of the CCTA programme in 1996 we have produced the following 
publications: 


— The Millennium Bomb—Can You Cope With IT? (an awareness briefing that introduces the subject) 
— The Year 2000 A Management Briefing covering Information Systems (aimed at business managers) 


— Defusing the Millennium Bomb (a report produced in 1996 with DTI, CSSA and PA Consulting 
assessing the state of readiness of organisations of the public and private sectors) 


— Planning a Year 2000 Programme (a briefing produced to support a seminar on planning) 


— The Millennium Bomb Its Impact on Telecommunications (briefing produced for government 
telephone network users) 


— Technology update Year 2000: Scoping the Problem (a briefing produced in co-operation with the 
Gartner Group) 


— Tackling the Year 2000 (a six volume set of guides that describes how to create and manage a 
programme of action from start to finish) 


The programme will continue to produce briefings. These will be based on topics that we and our customers 
in the public sector see as important and will initially be published in CCTA’s BEST Directory. Already 
planned are briefings on Embedded Systems and Contingency Planning/Disaster Recovery. 


CCTA Model Agreements (published by The Stationery Office) may be purchased by both public and 
private sector organisations. These Agreements all include a Year 2000 warranty and were first made 
available in September 1996. Discussions: continue with industry bodies to ensure that the clauses remain 
best practice. 


4. Advice and Information. CCTA has created a Year 2000 web site which is intended to be an information 
point. It includes details of our programme, including seminars, and links to other sites containing helpful 
information. We also run an open discussion group over the web. This activity stream includes a programme 
of conferences and seminars that has been under way since mid 1996. The programme started out with 
conferences aimed at raising awareness of the Year 2000 problem, including one for top of the office, and has 
developed into more focused seminars, each looking at a specific aspect. To date we have held seminars on 
planning and embedded systems and intend to hold further seminars on testing and contingency planning/ 
disaster recovery. Each seminar is supported by a briefing paper. 


5. Co-ordination of Public Sector Activity. CCTA chairs a regular meeting of the Year 2000 Public Sector 
Group. This was established at the behest of CITU and meets every 2-3 months to discuss progress and 
problems in public sector organisations. The group is open to all public sector bodies and is usually attended 
by Year 2000 project managers from about 25 organisations including most central departments. We also 
attend meetings of Year 2000 co-ordinating groups within some departments. Further afield, CCTA is 
represented on a number of other co-ordinating groups and attends meetings of Action 2000 and 
international public sector bodies such as ICA and IDA. We have established links with groups with a Year 
2000 interest eg CSSA and A KPMG IMPACT programme. 


6. Progress Monitoring. Apart from the general survey with DTI, CSSA and PA mentioned above, we have 
run two surveys of public sector bodies (Winter 1996 and Summer 1997). These asked samples of departments 
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specific questions about progress, costs, estimates and predicted end dates for their programmes. In general 
terms the two surveys indicated a high degree of certainty of completing programmes in time but progress is 
slow in getting systems converted. CCTA, working on behalf of CITU, assessed departmental plans 
submitted in October 1997 at the request of the Chancellor of the Duchy of Lancaster. 


28 November 1997 


APPENDIX 24 
Memorandum submitted by Morgan Stanley Group Inc 
INTRODUCTION 


Relevance of our organisation to the Committee’s enquiry 


Morgan Stanley, Dean Witter, Discover & Co. (“Morgan Stanley” or “The Firm’’) is one of the world’s 
largest securities firms with offices in 22 countries world-wide. Morgan Stanley Group Inc. recognised the 
seriousness of the Year 2000 problem in 1995, launched a project in 1996, and is currently completing the 
second year of a four-year project to ensure no disruption of service over the millennium year change. The 
Year 2000 Project is the largest IT project ever undertaken by the company and will cost the Firm of the order 
of $100 million. Additionally, Morgan Stanley is taking a leading role within the US-based Securities Industry 
Association (SIA) and other industry trade associations around the world to ensure that Year 2000 best 
practice is shared among members. 


Summary of main points of evidence 


— Morgan Stanley considers the “millennium bug” problem to be one of the most serious challenges 
facing the financial services industry today. Achieving timely compliance, adequate contingency 
planning, and building confidence through industry testing are requirements for success. 


— Government assistance in public and private sector contingency planning as well as support for 
regulatory oversight of Year 2000 efforts may reduce systemic risk. 


— Minimising potential new regulation that has a high degree of IT impact is essential over the next 
24 months. 


— Due to the imminent nature of the EMU deadline, companies may put off their Year 2000 
compliance efforts which could create an unmanageable resource shortage in 1999. 


— Companies are most at risk from potential failure of their external business relationships (over 
which they have less control). 


In response to the Committee’s request, Morgan Stanley is pleased to reply as follows: 


(i) Comment on “the nature, magnitude and implications of an inability to manage the date change in personal 
and mainframe computers, embedded systems and software, especially where such computers are performing 
safety critical operations” 


1. The scope of the Year 2000 problem within Morgan Stanley is extremely large and poses significant 
challenges to our organisation. Our technology infrastructure includes 88,000 mainframe programs, 400 
business critical client/server systems, over 16,000 desktop computers, and almost two million desktop 
spreadsheet and database files. In addition, we have identified approximately 6,000 external products and 
services used by the Firm worldwide, not including electronic interchanges with clients. 


2. To date, we have encountered Year 2000 date problems in nearly all of our internally developed systems. 
If we had not worked aggressively to complete the project in time, there would have been considerable 
disruption to the operations of the Firm. Left uncorrected, Year 2000 “bugs” would corrupt databases 
beyond repair, disrupt computing infrastructure, and halt operations. We have also found that networks, 
telecommunications infrastructure, and building systems are affected. In fact, the central building 
management system in our Canary Wharf office which controls and monitors fire-alarm, water detection and 
other safety systems has defective embedded chips and we have elected to completely replace the system. 


3. External products and service providers represent one of the greatest areas of risk due to our inability 
to control the quality of their compliance efforts. Presently, approximately one third of these providers claim 
to be Year 2000 compliant. An additional one-third is working towards compliance and has provided us with 
written project documentation and forecast product upgrade dates. The remaining one-third has provided us 
with incomplete or ambiguous information that has left us with a great deal of uncertainty regarding 
compliance plans, or in fact concern as to whether some of them will achieve compliance at all. We plan to 
test our most critical providers independently of their own efforts. 


(ii) Comment on “the effectiveness of action which has already been taken to avert problems in Government, 
large corporations and small businesses” 
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4. Government has been effective in raising Year 2000 awareness. In fact, we believe that Government has 
encouraged businesses to consider important issues such as the compliance of their own suppliers. However, 
we do not yet have much information regarding Government’s actual progress in correcting its own systems. 


5. Through our involvement with industry level initiatives, we believe that most large corporations have 
achieved Year 2000 awareness, assembled project teams, and are progressing in their efforts to achieve 
compliance. However, most corporations and governments are still struggling with the size and scope of the 
problem and frequently discover that the cost of compliance is double or triple initial estimates. This has also 
been true for Morgan Stanley as our current forecast project budget is approximately $100 million over four 
years, up from our estimates only a year ago of $50-60 million. 


6. We are concerned that smaller companies are less convinced of the enormity of the problem and may 
gain a false sense of confidence from their reliance on vendor provided software. In our experience, vendor 
software still requires testing and often requires time-consuming upgrades. In addition, due to the broad 
scope of the problem, small companies are likely to be affected by some form of hardware problems, 
embedded chip malfunctions, or more simply spreadsheet data errors. 


(iii) Comment on “the role of Government in raising awareness of the potential problems and in seeking 
solutions and the respective roles Taskforce 2000 and the recently launched Action 2000” 


7. The Government has made a significant impact in raising Year 2000 awareness. Frequent press coverage 
of statements by Government officials and Taskforce 2000 commentary has precipitated widespread 
discussion in the financial services industry. The results of the Government funded PA Consulting surveys 
have also been widely distributed; though the results indicate more work remains to be done. These kinds of 
efforts should continue. We do not yet have experience working with Action 2000, but look forward to their 
leadership in this area. 


8. Government and regulatory bodies could provide support by requiring Year 2000 disclosure on 
financial filings, and by fostering discussion and co-ordination amongst market participants regarding 
contingency planning and industry testing. Publishing the results of these efforts may help sustain investor 
confidence. 


(iv) Comment on “the extent to which new systems and software are ‘millennium compliant’” 

9. Morgan Stanley has found that not all new systems and software are millennium compliant and not all 
products that vendors have claimed to be compliant actually pass our testing. These failures may be partly 
because underlying components supplied to the vendor are in turn not compliant. We do not have enough 
experience with this issue yet to draw conclusions regarding percentage failures or causes, but this is an area 
of concern. Morgan Stanley will continuously test new systems and software installed between now and the 
year 2000. 


(v) Comment on “the development of contingency plans in the event of system and program failures” 


10. We believe that only companies with the most advanced Year 2000 projects are now beginning to 
approach contingency planning. Planning for the possible failure of each critical system, as well as building 
facilities, vendors, counter-parties, industry infrastructure, and regional liquidity is vast and only beginning 
to be addressed. We strongly believe that industry dialogue needs to extend beyond basic project 
methodology to encompass contingency planning approaches with some urgency. Discussion and co- 
operation among firms will be required to define the proper scope of “contingency planning” and to discuss 
the larger systemic issues. 


(vi) Comment on “the legal implications of disputes over liability for compliance costs and system and 
program failures” 


11. The legal implications of disputes over Year 2000 failures are significant. The ultimate liability for 
losses sustained as a result of system and program failures will depend in part upon individual contracts 
between organisations and will not be clear until precedent has been established. Morgan Stanley has been 
including Year 2000 compliance requirements in purchasing contract language for over a year and we intend 
to document due diligence with regard to the compliance of our suppliers over the next two years. 


Below we answer the specific questions raised by the Committee. 


Response to: What is your estimate of the seriousness of the millennium bug problem? 
f 


12. Morgan Stanley considers the “millennium bug” problem to be one of the most serious challenges 
facing the financial services industry today. At its worst, the millennium bug could create financial 
infrastructure risk such as: execution and settlement disruptions, funds transfer failures, and liquidity 
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problems. Achieving timely compliance, adequate contingency planning, and building confidence through 
industry testing can help ensure success. 


13. The Firm’s specific response has been to initiate the largest IT project ever undertaken by the company 
to ensure its internal compliance and to minimise the risk from its 6,000 external business relationships. 


Response to: To what extent do you think that UK businesses and other organisations have done, or will have 
done, enough to avert any potential problems? 


14. General awareness of the problem in the UK seems to have increased greatly over the last 12 months, 
but the seriousness of the problem needs continued emphasis. 


15. Due to the imminent nature of the EMU deadline, companies may put off their Year 2000 compliance 
efforts, which will create an unmanageable resource shortage in 1999. A pragmatic discussion on creative 
resource management over the next two years may help companies bridge the shortfall. 


16. Smaller companies may be at particular risk from inadequate capital to fix their problems or over 
reliance on third parties to supply compliant software. 


17. Co-ordinated testing among core suppliers and trading partners can help work out any remaining 
issues as well as increase confidence in the supplier chain. More discussion in the UK on how to achieve this 
is required. 


Response to: Do you think that the Government has done enough to raise awareness of the problems associated 
with the date change or to encourage action to avert problems? What more should be done? 


18. The Government has done a good job in raising awareness of the Year 2000 problem although smaller 
companies may yet not have received the message. Schemes to provide incentives for smaller businesses to 
divert resources to Year 2000 compliance might be considered. 


19. The Year 2000 issue is advancing to a stage where companies need to disclose exposure and progress 
in their individual projects, start contingency planning, and work together with counter-parties on industry 
testing issues. Government sponsorship for contingency planning and industry testing, particularly for the 
financial services industry, would be key to ensuring continued confidence in the market place. 


Response to: What, if any, are the major constraints militating against progress being made towards identifying 
and applying solutions to prevent computer systems and software failures at the millennium? 


20. Failure to disclose the extent of the problem or to acknowledge its seriousness can cause organisations 
to deny the potential threat it poses to their organisation. 


21. Resource availability is a major issue. Many UK organisations face the constraint of staffing both their 
Year 2000 and EMU projects. During 1998 and 1999 the cost of IT staff is likely to rise as organisations make 
last ditch attempts to achieve compliance on time. During that time, companies will have to prioritise systems 
and projects, deciding which to abandon to ensure that the more important systems are made compliant. 


22. To maintain confidence in the global financial markets, it is imperative that time is reserved in 1999 
for co-ordinated industry testing. 


23. Minimising potential new regulation that has a high degree of IT impact is essential over the next 24 
months. Securities houses and banks are already faced with potential IT work in connection with the 
following European and UK initiatives: EMU, CAD II (Capital Adequacy Directive), Implementation of 
Data Protection Directive, and new regulatory reporting requirements for the FSA. Government should try 
to avoid adding to this list. 


3 December 1997 


APPENDIX 25 
Memorandum submitted by the London Stock Exchange 


1. INTRODUCTION 


1.1 The London Stock Exchange has a statutory duty under the Financial Services Act 1986 to ensure that 
its markets operate in a fair and orderly fashion. For this reason, and for the well-being more generally of 
the UK financial industry, the Stock Exchange is taking all the necessary steps to ensure that it is well prepared 
for the Year 2000 date change. 
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2. SUMMARY OF KEy POINTS 


2.1 There are few areas of commercial or public sector life untouched by the implications of the Year 2000 
date change. Failure to prepare adequately will have serious repercussions. 


2.2 The level of awareness has increased markedly during 1997. However, there is much still to do. The next 
twelve months will be critical in determining whether the overall level of preparation in the UK is adequate. 


2.3 The Government has an important role to play in helping to raise awareness. However, there are a 
number of existing initiatives already underway and it is important to ensure that these are well co-ordinated 
and appropriately structured and resourced. Too many separate initiatives could divert attention away from 
practical preparations. 


2.4 Smaller organisations have generally been slower to respond to the issue. Many are now finding that 
the cost of preparation is rising at a prohibitive rate. 


2.5 The introduction of Economic and Monetary Union (EMU) will place a major additional burden on 
organisations preparing for the Year 2000 date change. These two projects together are likely to curtail the 
ability of many organisations to introduce new products and services in the next two-three years. 


2.6 The London Stock Exchange has a well structured and systematic programme of testing and systems 
enhancements to ensure that the risk of disruption to its operations is kept to an absolute minimum. 


3. GENERAL ISSUES RAISED BY THE INQUIRY 


Implications of date change 


3.1 Given that computer hardware and software and embedded microprocessors are now fundamental to 
almost all areas of commercial and public sector activity in the UK, any systemic failure could have very 
serious repercussions. Because of the unique nature of the issue and the fact that it is driven by an immovable 
end-date, it has to be faced now. Addressing the issues raised by the date change during 1999 is almost 
certainly going to be too late for all but the smallest organisation. 


3.2 The inherent problems created by the date change are compounded by the fact that it is very difficult 
to predict which devices do not utilise date dependent processing. In principle, therefore, all systems should 
be tested, creating an immense problem both in terms of cost and the numbers of people required to carry 
out the testing and verification process. 


3.3 For this reason, and because not all systems and processes are equally important, it is vital that 
organisations prioritise their effort according to well founded criteria such as business dependence, safety and 
financial risk. 


Effectiveness of action to date 


3.4 Prior to this year, the action taken by the majority of organisations appears to have been limited. That 
has changed dramatically during 1997. The feedback we receive from our network of advisory and 
consultative committees suggests that as far as our own constituent organisations are concerned, the vast 
majority are now well aware of the issue and are taking the necessary steps. 


3.5 However, as we near the end of 1997, it is clear that only a limited number of products are Year 2000 
compliant and even among these a number are still failing basic tests. 


3.6 The problem is most acute, we believe, in the smaller company sector. These companies have, on the 
whole, been slower to respond to the issue and are consequently vulnerable on two grounds. First, the 
necessary resources are becoming scarce. Second, the cost of these resources is rising steeply. It is possible 
that some firms will face serious difficulties, either because they run out of time or because they cannot afford 
to develop compliant versions of their products or correct problems in their own internal systems. We would 
expect the effects of this to be apparent well before the Year 2000 as companies start to change their suppliers 
in order to minimise their own risks. 


Extent of compliance 


3.7 Only a relatively small proportion of new hardware and software is certified Year 2000 compliant 
today. Compliant versions are typically being promised during 1998. This adds to pressure on timescales. In 
the case of the Stock Exchange, for example, we need to have a Year 2000 compliant version of our test system 
before we can test with the niarket. If our suppliers slip, this could have a domino effect across the market. 


3.8 Statements of compliance for devices with embedded processors—such as electrical appliances— 
would appear to be very rare at the present time. 
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Contingency plans 


3.9 The Year 2000 problem is not one that lends itself easily to the provision of contingency plans. In most 
cases, it is difficult to envisage a contingency plan that is practical (back-up systems are likely to have the same 
problems as primary systems). Manual contingency plans may be practical for limited periods in specialised 
circumstances, eg to keep an emergency service going. 


3.10 In the course of preparing for the Year 2000 date change, it may be possible for organisations to 
identify ways in which potential risks can be managed or reduced. However, we believe that the only truly 
practical solution to this problem is comprehensive testing and correction of any errors discovered. 


Legal implications 


3.11 Liability for losses flowing from non-compliant systems will, we believe, be determined by reference 
to the particular contractual relationship. We therefore believe that legal action should be a last resort. 


3.12 A practice is starting to emerge whereby some organisations are demanding legally binding 
statements of compliance in circumstances where service suppliers are unable to give it. We are concerned 
that this apparent positioning for potential litigation, in substitution for addressing the problem, is a very 
unhelpful practice. 


3.13 We are aware that the insurance industry is now actively examining this issue with the intention, we 
believe, of severely limiting its exposure to Year 2000 related claims. 


4. SPECIFIC QUESTIONS RAISED BY THE COMMITTEE 
4.1 What steps has your organisation taken to avoid potential computer systems problems caused by the 
date change at the millennium? 


4.2 The London Stock Exchange has already devoted considerable effort and resource, as well as 
management time, to addressing the issues raised by the date change. We are confident that we are already 
doing everything possible to minimise potential problems and to ensure that users of our trading and other 
systems are able to access those systems from 1 January 2000. 

4.3 The most significant steps we have taken—and are taking—include: 

— impact analysis and risk assessment for all our systems, both external and internal; 


— identification through Year 2000 compliance testing of the condition of all our systems in risk 
sequence (high—medium—low) to be completed in February 1998; 


— development of plans for upgrading, replacement or retirement of all non-compliant systems; 
— installation of all upgrade and replacement systems by end of 1998; 
— comprehensive retesting of all systems to verify compliance by end of 1998; 


— establishment of an “umbrella” project to manage all aspects of Year 2000 compliance, including 
embedded systems, insurance issues, legal issues, as well as computer systems as described above; 


— consultation with our market users covering selected member firms, service providers and software 
houses to determine their state of readiness and their expectations for testing arrangements with the 
London Stock Exchange; 


— development of a proposal to provide a market testing service to enable member firms, service 
providers and software houses to demonstrate compliance consistent with our obligation to run an 
orderly market; and 


—  weare also working closely alongside other regulators in our capacity as members of the Financial 
Services Authority’s Year 2000 Group. 
4.4 Do you think the Government has done enough to raise awareness of the problems associated with the 
date change or to encourage action to avert problems? What more should be done? 


4.5 Because of the all embracing nature of the Year 2000 problem, we do see a natural role for government 
in helping to address the issues raised by the date change. In particular, we believe the Government should 
have a role in the following areas: 


— raising public consciousness about the seriousness of the issue; 
— assessing the overarching legal and insurance issues; 


— heightening awareness and providing practical assistance to the more vulnerable organisations, 
particularly smaller companies; and 


— ensuring that all government systems—and those used on behalf of central government—can 
manage effectively the Year 2000 date change. 
4.6 As far as action already taken by government is concerned, the Taskforce 2000 initiative was, in our 


view, very effective in increasing general levels of awareness. However, it appeared to have little in the way 
of resources to provide more tangible assistance. 
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4.7 Action 2000 has only just been formed, but in order to make a serious and constructive contribution 
to the problem, it will need to demonstrate that it: 


— has sufficient resources; 

— isrun by people with an in-depth knowledge of the issues; 

— can very soon establish credibility within the IT industry; and 
— is clear about the practical help/work it will undertake. 


4.8 Those working in organisations on the date change issue are already in danger of suffering from an 
excess of information as they seek to absorb advice on highly complex and technical issues from a number 
of quarters. If Action 2000 is to make a valuable contribution, and not add to existing burdens, then it must 
have—and convey—a clear focus on what it is seeking to achieve. 


4.9 What, if any, are the major constraints militating against progress being made towards identifying and 
applying solutions to prevent computer system and software failures at the millennium? 


4.10 We would identify the following five general areas of potential constraint: 
—  acontinuing lack of awareness, particularly among smaller companies; 


— the high and escalating cost of addressing the problem, together with a lack of resources and 
necessary expertise amongst many organisations; 


— a lack of knowledge/documentation in relation to older systems; 


— an unwillingness in some organisations to divert funds and people from business-driven projects; 
and 


— complicated dependencies on the compliance of products from third-party vendors/suppliers, some 
of whom are smaller companies. Any failure of these suppliers will quickly compound the practical 
problems. 


4.11 To what extent does the planned introduction of the euro at the same time complicate the process of 
avoiding computer systems failures? 


4.12 There is no doubt that the advent of the euro is highly relevant in the context of the preparations being 
made for the Year 2000. The systems that have to be modified to support EMU will also have to be tested, 
and may need to be modified, for Year 2000 compliance as well. The same resources will often be needed 
within an organisation for both projects, significantly increasing pressure on already overstretched staff. 


4.13 Because of the similarity in timeframes, some may regard the implementation and testing of changes 
for both projects at the same time to be an enticing option. However, we believe this would be difficult to 
achieve in practice and could increase costs and exacerbate resourcing difficulties. Most organisations having 
to prioritise between work on Year 2000 and EMU, are likely to opt to work on Year 2000 because of the 
certainty of it occurring. 


4.14 Year 2000 and EMU are likely to be the two most important externally-driven IT-related projects 
that many organisations have to grapple with. Indeed, preparations for these projects may already be 
curtailing the capacity of some businesses to introduce new products or services before late 2000. Given 
existing workloads, we believe that any move to bring forward the possible date of UK entry into EMU would 
place severe additional burdens on many of these organisations. 


5. OTHER ISSUES 


5.1 The Committee invited the Stock Exchange to submit additional information which may be relevant 
in the context of the inquiry. We would draw the Committee’s attention to the following issues. 


Compliance 


5.2 To date, most organisations focusing on the issue have concentrated on the compliance of their own 
systems. Yet, many organisations have complex interfaces with others who in turn are likely to have their 
own Year 2000 programmes. At the Stock Exchange, we will be conducting a programme of collective testing 
sessions with our users. In order to help avoid significant gaps in overall Year 2000 compliance, we believe 
that other organisations with similar groupings of users would do well to adopt the same approach. 


The potential for instability after 2000 

5.3 Though the main focus of activity to date has been on preparing for the Year 2000 itself, we do believe 
that there are issues which go beyond 2000 and which need to be considered. 

5.4 We would highlight three issues in particular: 


/ * : a 
— The volume of change being introduced into computer systems to meet Year 2000 compliance could 
inject instability into otherwise stable systems. This instability may occur in areas other than date 
processing and could go on manifesting for a considerable period after 2000. 
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— The practice of using newly trained inexperienced programming staff to meet the resource shortfall 
for testing and modification could compound the instability problems. 


— The volume of change could also present opportunities for the committing of malicious damage or 
fraud. It would be possible, for example, for a suitably qualified programmer to hide fraudulent 
payments under the guise of year 2000 errors. 


5.5 In order to avoid these potential pitfalls, we believe organisations must maintain the same rigorous 
levels of control over changes and over staff that are required for all major systems projects. 


3 December 1997 


APPENDIX 26 
Memorandum submitted by British Nuclear Fuels ple 


1. INTRODUCTION 


1.1 BNFL is a large manufacturing organisation that is extensively reliant on information-systems to 
support its normal business operations; and on computer chips that are embedded in, and control, many of 
its process-control, safety and site-infrastructure systems. 


1.2 To this end, it has a requirement to ensure full compliance of these systems in correctly managing the 
date change from 1999 to 2000, and its approach to this issue will be of direct relevance to the Science and 
Technology Committee’s inquiry. 


2. COMMENTS ON KEy POINTS OF TERMS-OF-REFERENCE 


2.1 In regard to the points of particular reference in the terms-of-reference, our general comments are 
as follows: 


(i) Large organisations of all types are facing compliance issues in all of the categories listed. In relation 
to personal and mainframe computers, the magnitude is moderate, with the implications being mainly on cost 
and commercial risk. In the case of embedded systems and software, some of which are safety related, there 
is the further risk of precipitating injury, incident and lost production. The cost of achieving compliance in 
this area is likely to exceed the cost of achieving compliance in the personal and mainframe computer area 
for our type of organisation. 


(ii) It is our impression that larger organisations are progressing well in addressing the issue and that 
smaller businesses are behind. However, in general, projects are not sufficiently advanced to be confident of 
successful completion in time, and consequently, resources may become a problem as 2000 approaches. 


(iii) Taskforce 2000 was generally visible and contributed to raising awareness. However, the issue is now 
generally acknowledged in industry, and media coverage has taken over in maintaining awareness. Turning 
awareness into action, particularly in SME’s, remains a key issue. 

(iv) Our experience is that new systems can definitely not be assumed to be compliant. The development 
of today’s “new system” may have started several years ago when the Y2K problem was less high profile. 
This particularly applies to large bespoke developments. However, Y2000 compliance has been a condition 
of purchase for some time within BNFL. 


(v) Whilst there is a general understanding of the need for contingency planning, we expect this to be 
delayed in most organisations, primarily because it is too soon at this stage to predict progress against 
rectification plans, and therefore, how confident organisations will become as 2000 approaches. 


(vi) Our experience so far has resulted in BNFL having to stand the compliance costs, which typically 
involves upgrading to versions of software products/packages which the suppliers have certified as compliant. 
These upgrades are generally “free” as part of maintenance contracts. The cost involved is mainly that of 
manpower in carrying out the upgrade and the consequential enforced software modification/testing. Whilst 
the contractual background giving rise to this situation is varied, the main reason is that software suppliers 
have the right to “retire” software versions as they age and as new versions are released, and have no 
obligation to support and maintain old versions. 


_ Suppliers are at times taking advantage of the situation to force users to upgrade, by only certifying the 
current version as compliant. Often, suppliers will not provide a firm statement as to the compliance state of 
previous versions. 


3. COMMENTS ON THE SPECIFIC QUESTIONS ASKED OF BNFL 


3.1 In regard to the specific questions posed, our comments are as follows 


(i) Problems associated with mainframe and personal computers do not pose a major threat to BNFL. 
However, embedded systems and software will continue to be treated as priority until any necessary work is 
completed on assessment. 
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(ii) The company initiated a Compliance Project in mid-1996. The team is made up of representatives 
responsible for all areas of the business and a rigorous methodology is in place. Assessment of what is required 
continues and rectification work has started in some areas. BNFL does not anticipate any major constraints 
and is confident that major problems will be averted. 


BNEFL are pro-actively adopting an approach which takes special cognisance of safety related systems, in 
the expectation that our regulators will require such diligence. 


(iii) The BNFL compliance team has identified the potential plant problems of non-compliance, is 
confident of achieving compliance but, prudently, is developing contingency plans. Responsibility is shared 
between the Company’s IS Director and local management who are accountable for ensuring that their 
systems are compliant. 


(iv) Awareness is currently adequate. BNFL has not used Taskforce 2000 services or publications, but has 
taken guidance from other sources. These include a consortium of nuclear related organisations led by 
KPMG (IMPACT); collaboration with MAGNOX Electric; taking some initial education from AEA 
Technology; and using literature from suppliers and the British Computer Society. ; 


The Government should take particular interest in guaranteeing that utility providers and other major 
infrastructural services (electricity, water, gas supplies, transport, banks, BT, etc) avoid problems, since these 
have the potential to cause severe disruption to commerce and society generally. 


2 December 1997 


APPENDIX 27 


Memorandum submitted by GEC Alsthom Limited 


1. GEC Alsthom Limited is the UK holding company of the GEC Alsthom Group, one. of the world’s 
leading developers and manufacturers of equipment and services for electrical power generation, 
transmission, and distribution, for all forms of rail transport, and for various types of supporting industrial 
equipment. Its modern manufacturing facilities are heavily dependent on computer-based systems for a wide 
range of control actions, as is much of the equipment used to operate and maintain its sites. Similarly, the 
products and equipment manufactured by GEC Alsthom have benefited from major technical advances over 
recent years which, for example, have also dramatically increased efficiency and reliability. This is due to the 
application of computer-based analysis systems for their design, and to the incorporation of computer 
systems into the products themselves for sophisticated real-time control. It has only been possible to create 
products, such as the Eurostar train, because of the latter. 


2. At present we have no reliable estimate of the potential financial or other costs for GEC Alsthom of 
ensuring avoidance of computer problems arising from Year 2000 non-compliance. This matter is under 
review by the GEC Alsthom Group on a world-wide basis and is clearly not viewed on simply a UK related 
issue. We are, therefore, very much aware of the potential problem through our own computer experts, 
through the publicity actions of Government Departments such as the DTI Taskforce 2000, and through the 
initiatives of professional organisations such as the Institution of Electrical Engineers. Nevertheless the 
magnitude of the audit task, and the difficulties of obtaining definitive assessments on each potential item, 
are such that it is not yet completed. 


3. All products currently supplied by the GEC Alsthom Group are millennium compliant, and ensuring 
that this is so was a priority to us. With regard to those already “in the field” it is important to appreciate 
that many of them are major capital items of individual design or adaptation for a particular service. Such 
equipment often has a design life of 40 years or more, but usually with planned refits or upgrades at 
intermediate times. The position may, therefore, be categorised on a case-by-case basis in terms of products 
which are: 


(i) year 2000 compliant; 
(ii) not year 2000 compliant, but a year 2000 compliant upgrade release will be available; 


(iii) not year 2000 compliant, but it is commercially and technically feasible to perform the adaptations 
if so requested by a customer; 


(iv) not year 2000 compliant and it is not technically or commercially feasible to perform the 
adaptations. A migration towards a year 2000 compliant product might be offered to the customer. 


4. We are attempting to avoid problems arising internally by means of an exhaustive audit of all our 
systems and equipment which employ any type of digital processing equipment, ranging from personnel 
record software to controllers of all kinds of office and factory equipment. From this we are assessing those 
items that are at risk and are implementing Action Plans to remove, avoid, or disprove each such risk. 


5. We expect the preparation and initiation of such Plans to have been completed by the end of this 
calendar year, which is why no reliable estimation of the potential costs or risks is currently available. In spite 
of this we feel that some problems are likely to arise at the millennium change, but not on such a scale as to 
have severely damaging consequences to our operations. 
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6. Within our Company and the GEC Alsthom Group on a whole, we believe the need to assess the scale 
of the potential problem is now widely understood. We also well appreciate that as the assessment proceeds 
and understanding of all the implications increases, the extent of systems potentially at risk expands. It is 
therefore critical that all UK organisations should be aware of the need to initiate a serious assessment of 
potential problems. We cannot judge if the Government has done enough to ensure this amongst smaller 
companies, who may not have our benefits of our computer-aware staff and customers. That it should do so 
is in our view of the first importance. 


2 December 1997 


APPENDIX 28 
Memorandum submitted by PA Consulting Group 
1. INTRODUCTION 


1.1 PA Consulting Group’s experience with the Millennium Bug Problem 


PA Consulting Group is, and has consistently been, at the leading edge of providing innovative solutions 
to the Millennium Bug challenge. Our project management and technical skills are currently being used by 
a wide range of clients globally, to deliver successful Millennium programmes. 


1.2 Millennium Bomb global survey 


PA has consolidated an in-depth understanding of the Millennium Bomb Problem from working with a 
wide variety of organisations and also through conducting a series of surveys. Most recently we surveyed 
approximately 1000 public and private sector organisations world wide to gain a comprehensive picture of 
awareness levels and progress towards compliance (a copy of our report, “Defusing the Millennium Bomb”, 
is attached). It is essential to assess how other countries are handling the Millennium problem compared with 
the UK as this could have profound effects on our economy as a whole. 


2. IN PA’sS VIEW, WHAT IS THE EXTENT OF THE MILLENNIUM BOMB PROBLEM? 


2.1 The Millennium bomb is not being taken seriously enough 


Within PA’s Millennium client organisations, we have discovered that the majority of software and 
embedded systems are exposed to the Millennium Problem in some form or another. PA Consulting Group 
has repeatedly found that companies tend to underestimate both the amount of software they use and the 
extent of their exposure to the problem. 


2.2 The Millennium bomb has the potential to put an organisation out of business 


The Millennium Bomb is a deceptively simple problem but this does not lessen its potential for damaging 
effects on an organisation. 


3. How EFFECTIVE IS CURRENT ACTION THAT UK BUSINESSES AND OTHER ORGANISATIONS ARE TAKING TO 
AVERT ANY POTENTIAL PROBLEMS? 


3.1 Millennium programmes must gain momentum 


PA’s international survey revealed that since our previous survey in February 1997, there has been a 
significant increase in the number of companies who have completed an audit, from 9 per cent to 39 per cent. 
This is a considerable increase over a six month period, but leaves 61 per cent of responding UK organisations 
who have not yet completed an audit. It is PA’s view that many of these organisations are now seriously at 
risk of not achieving Millennium compliance. 


3.2 In most organisations progress has been made towards Millennium compliance, but there is still much to do 


Most larger organisations have made some progress towards achieving compliance, our survey shows. 
However, very few are as advanced as we would expect, given the complexities involved and the scale of 
investment required. If business continuity is to be maintained it is essential that organisations urgently focus 
on action plans to address their business critical systems, time is running short. 
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3.3 Small businesses are lagging behind larger organisations 


One disturbing aspect which our survey highlighted, is the lack of activity in Small/Medium sized 
Enterprises (SMEs). Respondents from smaller organisations showed lower levels of awareness and 
commitment. This is further supported by survey findings that suggested only 37 per cent had a formal 
Millennium programme in place to address the problem compared with as many as 80 per cent of larger 
companies. Clearly, this is a serious issue in a business group that may have few permanent IT resources. Help 
may be necessary to enable SMEs to reach compliant status. 


4. How EFFECTIVE HAS THE GOVERNMENT BEEN IN RAISING AWARENESS AND ENCOURAGING ACTION TO AVERT 
PROBLEMS ASSOCIATED WITH THE DATE CHANGE ISSUE? WHAT MorE COULD BE DONE? 


4.1 Taskforce 2000 


The increase in awareness levels reflected by the “Millennium Bomb” survey highlights the success of 
Taskforce 2000. Taskforce 2000 was very effective in bringing the Millennium Bomb problem to the attention 
of all those who were willing to listen. This initiative was strongly supported by private sector effort and 
resources. The Government has a responsibility to UK industry in continuing to achieve the objectives set by 
Taskforce 2000. 


4.2 Tighter controls over organisations by regulators 


The interdependencies between organisations throughout industry indicate that the Government should 
endorse all industry regulators to apply pressure on organisations, ensuring that British industry survives the 
Millennium. Even those organisations who address the Millennium problem are vulnerable due to lack of 
control over other organisation’s Millennium compliance standards. 


4.3 The Hong Kong Monetary Authority as an example 


Probably the most dynamic example of market regulators becoming involved has been in Hong Kong. The 
Hong Kong Monetary Authority (HK MA) have insisted that every bank and financial institution under their 
care must have a Year 2000 programme in place by the end of June 1997. The banks in Hong Kong are 
working hard to ensure that the Year 2000 arrives with minimum impact to their businesses. 


4.4 Introduction of the Euro unnecessarily increases costs and risks 


Planning to delay EMU for the United Kingdom until 2002 eases the strain on business. However this 
promise, in the interest of British industry, is simply not enough. If the EC plans to introduce the Euro before 
or shortly into the new millennium, many companies in the UK will still have to address the EMU issue to 
avoid being left behind by their European competitors. This puts IT resource under tremendous pressure. It 
is therefore the responsibility of the UK Government to actively encourage the EC to ensure that these aspects 
are fully taken into account in deciding the timing for introduction of the Euro. 


5. WHAT ARE THE MAJOR CONSTRAINTS MILITATING AGAINST PROGRESS BEING MADE TOWARDS IDENTIFYING 
AND APPLYING SOLUTIONS TO PREVENT COMPUTER SYSTEM AND SOFTWARE FAILURES AT THE MILLENNIUM? 


5.1 Misleading awareness levels? 


Our survey findings suggest that although respondents claim to be fully aware of the Millennium Bomb 
issue, this may only be founded on a superficial knowledge of the problem. While 87 per cent of respondents 
claimed to be fully aware of the Millennium Problem’s impact, only 39 per cent of UK organisations had 
completed an Audit of systems, etc which are affected. Over half of all respondents had not, or had not 
planned to, include embedded systems in the scope of their audit. 


5.2 Lack of resources is causing rapid increases in costs and risks 


PA’s global survey shows that 44 per cent of all resource used is expected to be supplied by external 
organisations. A rising demand for specific skills (eg COBOL Programmers, Project Management, IT 
Consultancy) is likely to substantially increase costs. Research by the CSSA shows that wage inflation in the 
sector is between two and four/times the average. The association warns “this will inevitably lead to rises in 
the costs and risks of IT projects”. Many respondent organisations could not accurately estimate the potential 


pas of the Millennium Bomb on their business, in particular the total cost of fixing the Millennium 
problem. 
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5.3. Millennium programmes should be business driven 


In many organisations the Millennium problem has presented a large and complex challenge. This has 
generally been directed straight to the IT department who may have never dealt with such a unique problem 
before. PA’s international survey results show that only 55 per cent of Senior Managers are fully aware of 
the Millennium issue. This is extremely discouraging as it suggests that senior management are ignoring risks 
which can potentially cause serious damage to the whole business. 


The Millenium Bomb should not be perceived as being purely the IT department’s responsibility. Senior 
management commitment is vital if risk to the business is to be minimised. IT staff must tackle the low senior 
management awareness to get their Millennium programmes into action with full business backing before it 
is too late. PA recommend that organisations include a progress statement in their annual reports in order 
to demonstrate to their shareholders that they are taking the Millennium Bomb problem seriously. 


5.4 The complex scale of the Millennium bomb problem 


Potential obstacles in tackling the Millennium Problem are a lack of understanding the total scope of the 
problem and the processes required to solve it. These include tracing each supply chain and identifying all 
external interfaces. This can still be a laborious process even if external organisations choose to co-operate. 
Many suppliers are concentrating on becoming Millennium compliant themselves and neglecting, or openly 
ignoring, their customers and suppliers. 


5.5 IT Project management problems 


IT departments are infamous for budget and schedule overruns. A recent survey conducted by PA’s Pugh- 
Roberts Associates, Cambridge, Massachusetts, noted that half of development projects fail to meet their cost 
and schedule targets. This emphasises how important it is for organisations to have a formal programme plan 
in place, particularly considering the ultimately immovable deadline of any Millennium project. PA’s 
Millennium Bomb survey suggested that, on average, as many as 40 per cent of organisations are not running 
a formal programme plan. There wil be an increasing need for many more skilled IT programme managers. 


5.6 The deadline cannot be delayed if companies are not ready 


There is now an extremely short period of time remaining before the Year 2000. According to our survey 
findings 61 per cent of respondents estimated that they would be impacted before 2000, or already have been 
impacted, however nearly all Millennium programmes are scheduled to be completed by the end of 1998. It 
is crucial for organisations to tackle the problem effectively BUT some compromises may be necessary to 
finish before the organisation is impacted. 


3 December 1997 


APPENDIX 29 
Memorandum submitted by UK Year 2000 Interest Group 


1. INTRODUCTION 


1.1 The UK Year 2000 Interest Group was formed in April 1996 as a non profit making organisation and 
has subsequently established itself as a central player in the UK Year 2000 community. It is constituted as a 
self help group with the primary aim of exchanging information between members to assist them to tackle 
the Millennium problem. The membership is made up from a broad range of companies and organisations 
spread across the UK. The Group has held numerous events including two UK Year 2000 Vendor clinics. It 
has held workshops looking at testing, embedded systems (including separate sessions for manufacturing, 
office systems and utilities) and resourcing issues and has been solely responsible for bringing the utilities 
sector together to discuss common issues. 


1.2 The Year 2000 problem affects individuals, companies and organisations in all countries throughout 
the world. The scale of the problem is unknown and currently is of uncertain outcome. Without determined 
action the risk ranges from extremely serious to catastrophic. Even with intensive action throughout the 
available time left for resolution, the risk ranges from inconvenient at best, to remaining extremely serious 
at worst. 


1.3 The UK Year 2000 Interest Group is not authorised to disclose specific information relating to any 
one company or organisation. The evidence provided to the inquiry is therefore given in a general context 
from experience gained over the last two years by practitioners and leading experts in Year 2000 projects. 
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2. GENERAL RESPONSE 


2.1 It is our opinion that at a component level, the year 2000 problem is relatively simple to understand. 
However, from the range of where it can be found and the magnitude of occurrence we believe it presents a 
unique and complex challenge not only to individual companies but the public sector, UK ple and indeed 
throughout the world. The consequences of our inability to successfully manage the problem could be 
catastrophic. 


2.2 Our experience shows that the longer an organisation has been working on the Year 2000 issue, the 
more concerned it becomes about its ability to overcome the problem. It is important to recognise that this 
is not just because the initial assessment is nearly always understated and resolution becomes more complex 
with knowledge and experience but that the key to resolution lies in the “supplier chain”, eg suppliers, 
customers and partners over whom you may have little or no control. In addition, each supplier, customer 
and partner has exactly the same problem throughout their own supply chain. 


3. RESPONSE TO QUESTIONS 


3.1 What is your estimate of the seriousness of the Millennium bug problem. 


3.1.1 Itis clear that we do not know the extent of the problem currently facing the world. Within the UK 
the three major significant areas of most concern must be: 


— Continuity of supply from utilities (both primary and Public Service) 
— Continuity of food supply 
— Continuity of financial services 


3.1.2 As stated earlier, each organisation is part of a National and International supplier chain outside 
their own control. For example, can a water company provide water if electricity is cut or can a bank function 
if International telecommunications are broken? 


3.1.3 Until the above three areas of significant impact are eliminated from being at risk, the seriousness 
has to be of the highest possible category. Assuming that these can be dealt with satisfactorily, one must then 
turn to lower levels of seriousness if failure occurs within Health, Transport, Defence etc. 


3.2 To what extent do you think that UK businesses and other organisations have done, or will have done, enough 
to avert any potential problems. 


3.2.1 For an organisation to be a member of the UK Year 2000 Interest Group it must, by definition, have 
already recognised that something needs to be done. Our members are therefore not typical across industry, 
they include the leaders and pace-setters within their own sectors. (They include High Street Banks, Retailers, 
Utilities etc). However, even within our own membership, we cannot cite any member who claims that they 
are already compliant. 


3.1.3 We conclude from this lack of evidence of completion, that progress has been too slow. Although 
awareness of the Year 2000 problem has significantly increased over the last year, we see no indication that 
the pace of progress is yet fast enough. 


3.3 Do you think that the government has done enough to raise awareness of the problems associated with the 
date change or to encourage action to avert problems? What more should be done? 


3.3.1 Apart from Taskforce 2000, we have been unaware of any other Government sponsored initiative, 
until the recent announcement of Action 2000. Taskforce 2000 appears to have had modest funding but 
despite this has significantly raised awareness at boardroom level in the major companies. Throughout UK 
ple awareness has dramatically improved in the last year, but action and resolution still seems to be low. 


3.3.2 One of the major inhibitors to progress is that organisations are reluctant to talk publicly of their 
own Year 2000 problems. This appears to be for two main reasons. Firstly they are concerned about their 
own share price and secondly for competitive advantage. 


3.2.3 Opinion from our members is that the Year 2000 problem is still, incorrectly perceived to be an IT 
industry issue. The organisations most advanced within Year 2000 programmes now recognise that their 
business is at risk if suppliers, customers and partners fail to resolve their own Millennium issues. 


3.3.4 Evidence is emerging that the identification and resolution of Year 2000 problems in the embedded 


ea ey may be bigger than anticipated. Information about the problem, scope and resolution is urgently 
needed. 


3.3.5 Strong leadership is required if we are to resolve the National.and International issues. Action 2000 
may become the conduit for Government action. However, it is crucial that whatever group takes on 
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responsibility for mobilising UK plc, it must provide strong leadership and does not just become a talking 
shop. Each week of delaying action is | per cent off the time remaining. 


3.3.6 Contingency and business continuity plans need to be developed to cover failure of services. 


3.4 What if any are the major contraints militating against progress being made towards identifying and 
applying solutions to prevent computer systems and software failures at the millennium? 


3.4.1 Adequate awareness has not yet been achieved and the views that “Someone else will solve the 
problem for me” or “It’s all hype” and “It’s an IT problem” are still frequently quoted. Advice to all 
companies to ensure awareness and advice on how to tackle the problem needs to be issued. 


3.4.2 Regulators need to be insisting on Year 2000 action plans. 


3.4.3. Year 2000 needs to be clearly stated as the number one issue. Other “mandatory” work must take a 
lower priority and should only continue when the Year 2000 problem is known to be under control. Political 
issues must not be allowed to get in the way. 


Il December 1997 


APPENDIX 30 
Memorandum submitted by The National Computing Centre (NCC) 


Prepared by Dr John Perkins, Director for Membership 


1. NCCis an independent IT Services Group which was founded in 1966. It provides products and services 
to clients internationally, aimed to reduce business risk in the use and supply of information systems and 
technology. 


2. NCC has been offering guidance and services relating to the millennium date change problem since the 
beginning of 1995. It has built up a significant knowledge base which it uses to further develop practical steps 
to help its members and clients ensure their business continuity through the millennium transition. 


3. The millennium problem is an issue of risk assessment and planning for business continuity. It is not a 
technical issue. It is unique for three core reasons: the date of the change is immutable, every person and 
enterprise is involved, we are all connected to computer systems which are all connected one to another. 


4. The problem and its possible extent are well documented and that documentation is growing all the time. 
We are not short of words or descriptions. We are short of sensible, practical ways in which enterprises, 
particularly smaller enterprises, can assess risk and develop and resource action plans to deal with it. 


5. NCChas developed a service called Escrow 2000, for example, which offers a very practical way in which 
enterprises can contain their risk in the event that software fails to handle the millennium date change. We 
are also developing, with DTI support, a business assurance scheme for SME’s which will allow them to 
rapidly assess their exposure to the problem and suggest appropriate action. This will be delivered through 
Business Links and promoted through other intermediaries. These are the kinds of measures which are needed 
if we are to turn awareness into action. 


6. Action 2000 is a welcome move on the part of the Government and has the wholehearted support of 
NCC. However there is more that could be done outside of Action 2000. For example the Government fund 
a variety of technical, business and educational support programmes which could all be encouraged to 
contain a Y2K component and Government contracts with TEC’s and their sub-contracts with the Business 
Link Partnerships could be used to encourage positive action in relation to the problem on behalf of SME’s. 
The new Ministerial Committee could examine these and other ideas across the Departmental boundaries. 


7. Sharing of good practice within and across industry sectors and between the private and public sector 
is recognised as an important mechanism for enhanced effectiveness in dealing with the problem. Constraints, 
whether they be technical, procedural or legal, need to be analysed and removed wherever possible. This is 
a particular issue where enterprises need information from infrastructure providers to properly assess their 
own business risk. 


8. The Government must recognise that international trading is a major component of the problem and 
therefore its European and global dimensions must not be overlooked. 


9. The voluntary sector must not be allowed to fall between the stools of public and private sectors. For 
example, the Lifeboat service is essential to safety at sea but is a voluntary organisation with restricted if well 
focused resources. 


10. AIDA is a well known acronym within the advertising business used to describe the purchasing 
process. The letters stand for awareness, interest, desire and action. In communicating effectively the two 
middle letters should not be overlooked. The wider business community is not yet passionately interested in 
this issue. Awareness is not at issue, passionate interest certainly is. 
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11. No effective channel into the business community should be ignored. For example there are at least 
10,000 computer “manufacturers” in the UK, the majority of whom are direct marketers and local retailers 
of self assembled hardware and systems. Many SME’s source their requirements from these suppliers who 
should be a natural target for communication but one which it is easy to overlook. 


12. In planning beyond the millennium date change lessons must be learned. The complete transparency 
of most IT systems to the user is a benefit and a threat. It leads to greater business focus but also to a lack of 
understanding about risk and dependency and a gulf between the business professional and the professional 
who enables the systems upon which the enterprise ultimately depends. The millennium date change is as 
much a symptom as a problem for the private and the public enterprise. 


13. NCC believes that the risks associated with the millennium date change can be reduced to an acceptable 
level. However to do so will require a combination of vision, commitment and practical support. It will 
require the shared efforts of the whole business and IT community. The government cannot solve the problem 
but it can do much through direct action and through facilitation to enable that process. NCC will provide 
every support it can to those efforts. 


2 December 1997 


APPENDIX 31 
Memorandum submitted by The Sage Group plc 


1. INTRODUCTION—THE SAGE GROUP PLC 


Sage is the world’s leading supplier of PC accounting and payroll computer software for small and medium- 
sized enterprises (SMEs), with over one million customers worldwide. Sage has over 16 years experience of 
developing computer software for this market, and is intimate with the business and the technology issues 
that the Year 2000 issue raises for smaller companies. Sage has been working on the Year 2000 issue for over 
two years—most recently, Sage, the DTI and Tate Bramald Consultancy conducted the industry’s first major 
research on attitudes to Year 2000 issues and current levels of Year 2000 compliance in the SME sector. 


2. SUMMARY OF EVIDENCE 


Sage believes that the Year 2000 issue will have widespread and potentially damaging effects unless more 
is done to raise awareness and promote action in the SME community. Much of the industry, media and 
government focus on Year 2000 has been directed at the UK’s largest organisations. SMEs do not have the 
resources to tackle the issue head-on; they lack understanding of the seriousness of the issue; and too many 
will wait until it is too late before moving to address the issue. Through Action 2000 the Government should 
establish a comprehensive advertising campaign, aimed at SMEs, through the small business and vertical 
market press. This will raise awareness by promoting the issue through SME channels and prompt small 
businesses to take action. 


3. THE NATURE OF THE YEAR 2000 IssuE 


The Year 2000 issue exists because of computer programming methods in the 1960s and 1970s. During this 
time, computer memory and computer storage space were at a premium, so computer software companies 
looked for any way to reduce the requirement for memory and storage space in their applications. 


4. One way was to reduce the number of digits used to store dates. Instead of storing a four-digit figure 
for the “year” part of the date (for example, “1997”) the last two digits only were used (“97”). Unfortunately 
this means that the computer system has no way of knowing whether “97” refers to 1997, 1897, 2097 or any 
similar date. At that time it seemed unlikely that these computer applications would still be in use in the next 
Millennium—but many still are. Many still run on mainframe computers in some of the UK’s largest private 
and public sector organisations, and the two-digit date tradition has in many cases perpetuated to the 
present day. 


5. This means PCs can also be affected. Some applications that run on these systems will not be able to cope 
with the Year 2000 date change. In addition, the hardware BIOS (Built-In Operating System) that controls 
fundamental aspects of a PC’s operation—including date and time in the system clock—may not recognise 
the Year 2000 date change. 


6. Embedded systems can also be affected. Any tool, appliance or system that uses microprocessors to 
process date information may’ not be able to cope with dates in the next Millennium—from faxes and 
telephones to video recorders and lifts. PC peripherals may also be at risk. Some, such as printers and plotters, 


contain their own processing logic and computer memory and will need to be checked for Year 2000 
compliance. Most will contain embedded systems. 
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7. THE MAGNITUDE OF THE YEAR 2000 IssuE 


Because ability to manage the Year 2000 date change differs from computer system to computer system, 
it is difficult to establish the exact magnitude of the issue. However, since most organisations rely on 
computers to control at least some of their day-to-day functions, and since many of these will be safety-critical 
or business-critical functions, the Year 2000 issue must be treated as an extremely serious problem indeed. 


8. In business, computers are used to automate and simplify complex and routine processes for greater 
efficiency. But this efficiency depends upon the inherent reliability of computer systems. When this reliability 
is called into doubt—as it will be for computer systems that have not been checked for Year 2000 
compliance—these benefits will be lost. 


9. And, because the effects of non-compliance will also be varied, it is impossible to predict exactly what 
will happen when a non-compliant computer system is switched on in January 2000. Possible effects include: 
computer systems resetting to the date of manufacture; systems crashing with possible loss of data; systems 
assuming that the date is 1 January 1900, or any other incorrect date; or incorrect calculation of date- 
dependent transactions. In business computer software this could translate into incorrect calculation of 
payroll, tax details, purchase orders, invoices, stock recalls, or any other time-independent process. 


10. THE IMPLICATIONS OF THE YEAR 2000 ISSUE 


The uncertainty over Year 2000 compliance in different computer systems means that all systems should 
be checked to be certain that business processes will continue to function in the next Millennium. For large 
organisations this is likely to be expensive and time-consuming, as there will be many mainframe, midrange 
and personal computers that will need checking. But large organisations have the financial resources, and 
often the in-house expertise, to address the issue effectively. There has also been a great deal of industry, 
government and media interest in the effects of the Year 2000 on large organisations. For many of these 
organisations Year 2000 is well understood and for them it is now a question of allocating budget and time 
to the issue. 


11. For smaller companies the issue is more pressing. SMEs typically do not have the internal resources 
to tackle the issue themselves, and many are still unaware of the real seriousness of the Year 2000 issue. This 
was shown by the Sage/DTI study into the effects of the Year 2000 issue on smaller businesses, which looked 
at awareness of Year 2000 issues and preparedness among SMEs in all industries. Although 97 per cent of 
the small businesses surveyed said they understood the Year 2000 issue, more than half planned to wait until 
1999 before allocating any budget to it. 


12. This is far too late for two key reasons. Firstly, these companies will begin to notice the effects of the 
Year 2000 issue on their computer software towards the end of 1998, when their accounting, stocks and other 
systems begin to process transactions that involve dates in the next Millennium. Direct debits, standing 
orders, stock returns and many other processes will be affected. Secondly, by 1999 the IT industry will be low 
on the skilled resources necessary to conduct Year 2000 auditing and fixing for such a large percentage of UK- 
industry. This effect is noticeable now. The bottom line is that SMEs that wait until 1999 risk starting the 
Year 2000 without their business-critical systems. 


13. WHAT Is SAGE’S ESTIMATE OF THE SERIOUSNESS OF THE MILLENNIUM BUG PROBLEM? 


It is important to separate the impact of the Year 2000 issue on UK industry as a whole from the impact 
it will have on individual businesses. For a typical SME, the process of auditing and fixing computer systems 
will be manageable and short-lived. But if today’s state of unpreparedness continues into 1999, the cumulative 
effect on industry will be much more serious. Something like 90 per cent of UK companies fall into the SME 
bracket—a huge number of companies running PCs and peripherals, telephone systems, fax machines, 
photocopies and any number of appliances that depend on embedded systems. While the effects of the Year 
2000 issue on a single business may only require a few weeks’ work to remedy, collectively the failure of many 
systems in the new Millennium will place a huge strain on the resources of the IT industry and may adversely 
affect the economy. 


14. Tue EFFECTIVENESS OF ACTION WHICH HAS ALREADY BEEN TAKEN TO AVERT PROBLEMS IN GOVERNMENT, 
LARGE CORPORATIONS AND SMALL BUSINESSES 


Although awareness of the Year 2000 issue has been raised by the IT industry, the media and the 
Government’s Taskforce 2000 initiative, it is clear that these campaigns have overlooked a large proportion 
of the SME community. The Sage/DTI study showed that, although most SMEs said they understood the 
issue, many plan to leave it too late to do anyting about it. Overall, only 13 per cent of the organisations 
surveyed had Year 2000 compliant systems. And 45 per cent had yet to undertake a “systems audit” to 
establish exactly which computer systems need fixing. 


15. Year 2000 compliance varies temendously by industry sector. Sage found that a high percentage of 
companies in the motor trades had already undertaken systems audits, and that this sector was best prepared 
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for the Year 2000 overall. In contrast, the government, education and health sectors were worst prepared for 
Year 2000, with nearly three-quarters of companies surveyed planning to wait until 1999 before allocating 
budget to the issue. 


16. THE ROLE OF GOVERNMENT IN RAISING AWARENESS OF THE POTENTIAL PROBLEMS AND IN SEEKING 
SOLUTIONS AND THE RESPECTIVE ROLES OF TASKFORCE 2000 AND THE RECENTLY LAUNCHED ACTION 2000 


While Sage feels that Taskforce 2000 was extremely effective at raising the profile of the Year 2000 issue, 
the lack of information and action in the SME community is worrying. Typically, smaller companies are not 
sources of IT expertise. They are more concerned with day-to-day issues, such as paying next week’s wage 
bill, than with keeping up-to-date on the latest IT news. This means that much of the current Government 
focus on Year 2000—which is aimed at larger companies, chiefly through the national and corporate IT 
press—will do little to improve the situation in the SME sector. 


17. And, while Sage welcomes the introduction of Action 2000 it is disappointing to see that the Chairman 
is only able to devote one day per week to maintaining the momentum of the Government’s Year 2000 
initiative. More is needed to support the SME sector. Sage welcomes the introduction of Millennium Week 
to raise the profile of the issue, but strongly believes that a well-planned Action 2000 advertising campaign 
is needed to attract the attention of the UK’s small companies. From extensive market research into the SME 
market Sage we know that SMEs tend to read vertical market publications that are relevant to their 
businesses. By targeting small business and vertical market publications, and by giving comprehensive 
information on the Year 2000 issue, the legal situation, how to approach suppliers, and industry-specific areas 
for concern, this campaign would raise awareness for the SME sector and prompt smaller companies to 
take action. 


18. DEVELOPING CONTINGENCY PLANS IN THE EVENT OF SYSTEM AND PROGRAM FAILURES 


At Sage we recognise that, in spite of our best efforts, some SMEs will not address the Year 2000 in time for 
the next Millennium. We are in the process of preparing contingency plans for this situation, but it is crucial to 
realise that the success of these plans will be affected by the preparation that other suppliers have made for 
the Year 2000. For example, although Sage software will be compliant, businesses will still face difficulties if 
other areas of their IT systems are not. 


Without a total, universal commitment from industry and Government it will be impossible to ensure any 
level of security for business-critical systems in January 2000. 


3 December 1997 
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APPENDIX 32 


Memorandum submitted by SmithKline Beecham plc 


SmithKline Beecham plc (SB) is one of the world’s leading healthcare companies. We discover, develop, 
manufacture and market pharmaceuticals, vaccines, over-the-counter (OTC) medicines and health-related 
consumer products. We also provide healthcare services including clinical laboratory testing, disease 
management and pharmaceutical benefit management. SB is the UK’s second largest pharmaceutical 
company by sales and is sixth in the FT’s ranking of the country’s largest companies by market capitalisation. 
We employ approximately 8,300 people in the UK out of a total of 53,000 worldwide. The company has 
operations in 160 countries. 


SmithKline Beecham was one of the leaders in recognising the magnitude of the Year 2000 computer date 
change problem. Our experience of tackling this unprecedented problem in a global distributed computing 
environment perhaps means that we are better placed than many to:judge the scale of the threat and the best 
way to avoid business disruption. 


As the following evidence demonstrates, SB’s experience shows that: 


— The Year 2000 is a serious threat to business continuity. Assuring the viability of business critical 
systems must be a top priority for all organisations in the public as well as the private sector. 


— The threat posed by non-compliant suppliers, customers and business partners is crucial. All 
organisations must work with key third parties to minimise the potential for disruption. 


— The Year 2000 problem is complex. There is no quick fix. 


Our responses to the specific questions posed are as follows: 


1. What estimation has your organisation made of the seriousness of the millennium bug problem to your 
organisation? 


Left unaddressed, the Year 2000 problem would arguably have been the biggest threat to business 
continuity that SmithKline Beecham has ever faced. As a global research-based company operating in 
complex and fast-moving healthcare markets, SB cannot compete effectively if it is unable to create, analyze, 
communicate and share accurate, timely and reliable information. Information is not only the nervous system 
of our business organisation, it is also in a very real sense a critical ingredient to our products. In some of our 
businesses, in fact, information is our product. Disruption resulting from Year 2000 related system failures 
would have significant negative impact on these abilities and could, if unchecked for a significant period of 
time, inflict serious damage to the business. However, because SB has been aggressively addressing Year 2000 
issues for several years, we do not anticipate significant negative impact or serious damage to our business 
from international systems disruptions. 


When we began to look at the problem in 1995 we quickly recognised not only the seriousness of the threat, 
but also the scale of the challenge that faced us as a global organisation. The Year 2000 problem potentially 
affects every form of digital technology in every part of the business, in every corner of the globe and is not 
isolated to any particular type of computer system or programming language. 


The seriousness with which we take this issue is demonstrated by two facts: 


— By direction of our Chief Executive, the Year 2000 corrective action programme is the top priority 
for SB Information Resources (SB’s information technology function) after servicing the critical 
day-to-day operational information needs of the business. 


— Fixing the Year 2000 problem will require an increase in Information Resources budgets of around 
15 per cent over the three-year period from 1997 to 1999 incrementally in addition to the 
reprioritising of approximately 10 per cent of our baseline resources. Additional resources in the 
year 2000 will undoubtedly also be required to cope with shocks experienced by our upstream and 
downstream business partners. 


2. What steps have been taken, and when, to avert problems in computer systems and software at the millennium? 
How much work remains to be done to ensure a smooth transition from 1999 to 2000? How confident is your 
organisation that it will encounter no problems at the millennium resulting from the inability of computer systems 
to handle the date change? 


SB began to investigate the scope of the problem in 1995. We established and staffed a dedicated Year 2000 
Project Office in early 1996 and appointed Year 2000 coordinators throughout many of our business units 
shortly thereafter. Our Year 2000 programme is composed of four phases derived from a methodology 
developed by IBM (Diagram 1) which we have significantly extended to deal with specific requirements in 
our highly regulated research and manufacturing processes. 


The first 12 months of our Year 2000 Project focused on creating awareness throughout the company and 
completing Phase I, the “Assessment and Strategy” phase. 
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SmithKline Beecham’s 130 Information Resource departments, located in 89 countries, completed Phase 
I for all of our operations in June 1997. Among the key tasks were: 


— Completing a global inventory of SB information systems applications and technology 
environment. 


— Creating vendor compliance standards to be used to track and evaluate the progress of our 
information system technology suppliers. 


—  Prioritising applications and creating “partitions” of groups of applications which must be 
managed as a unit because of high levels of information interdependency. 


— Developing remediation methods and testing capabilities. 


— Performing early pilots on our key technology platforms to identify the special problems each 
inevitably entails and evaluate the use of automated tools. 


— Developing a methodology for the implementation phase for each SB computing environment. 


Year 2000 teams across the company are now working on Phases IJ and III. These next steps require that 
changes to critical systems be identified before remedial and testing plans are implemented. Phase IV is 
underway in parallel with these steps and is designed to prevent the reintroduction of Year 2000 problems to 
systems or technology platforms once they are initially cleansed. 


SB current plans call for the completion of Phase II and III for all critical systems by the end of 1998, 
reserving 1999 and 2000 for final clean up and contingency management. While we recognise that these plans 
are aggressive, the programme is proceeding rapidly although rates of progress do vary depending on country, 
business unit and the technology challenges being addressed. Our programme extends to cover all forms of 
digitally controlled equipment such as factory process control, laboratory instrumentation and facilities 
environment operation. 


No one in SB underestimates the scale of the task. Over 300 person years of effort has been expended since 
1997 but a huge amount of work remains which must be completed in the next two years. Notwithstanding 
the scale of the challenge, because of the commitment of our executives, managers and professional associates 
top to bottom within our company, we are confident that all internal business critical systems will be 
compliant before the end of 1999 and that disruption to our systems will not be significant. 


3. What, if any, are the major constraints on your organisation which may hinder work on averting computer 
system and software failures at the millennium? 


SmithKline Beecham is confident that its business-critical systems will continue to operate before, during 
and after the turn of the millennium. There are, however, some challenges that are inherent in the Year 2000 
problem, especially for those organisations, like SB, which operate distributed computing environments and 
have sophisticated electronic links with customers, suppliers and other key third parties. 


From the beginning, SB adopted a co-ordinated global approach which promotes the use of best practice 
and eliminates duplication wherever possible. Ultimately however, fixing and testing systems calls for hands- 
on skills and especially extremely effective project management. Such skills are in increasingly short supply 
im many parts of the world (especially in the UK and the US but now increasingly in other markets as well). 
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As a result, we pay particularly close attention to the needs of our technical staff, both in terms of competitive 
financial compensation as well as long-term career development. 


Another technical consideration that makes the Year 2000 issue a labour-intensive task is the need to treat 
all systems as suspect unless and until proven otherwise. To date, our testing has revealed that many systems 
will have date problems unless remedial action removes and corrects the source causes. In fact, to our dismay, 
many third-party software packages have produced date errors when subject to validation challenge tests, 
despite vendors’ claims of compliance. We regard these results as justification of our rigorous, although 
expensive, approach to evaluation and testing. When it comes to the Year 2000, it is clear that the best advice 
is to “trust no one and test everything”. 


Arguably the biggest threat to our company comes from non-compliant suppliers, customers and other 
business partners. In addition, the technical challenges and stress on the available supply of technically skilled 
personnel posed by the superposition of the Year 2000 with the early phases of introduction of the European 
Monetary Union should not be underestimated. 


4. Has your organisation developed contingency plans should computer systems fail at the millennium? What 
would be the consequences of such a computer failure for your organisation? Whom would you hold to be 
responsible? 


SB’s aggressive global Year 2000 plans are designed to ensure that our business-critical computer systems 
avoid disruption before, at and after the millennium. We are tracking our progress monthly on an all points 
basis across the globe. If critical milestones are missed, resources will be marshalled and contingency plans 
will be implemented as second lines of defence. As stated above, probably the biggest threat comes from the 
ripple effect of non-compliant suppliers, customers and business partners all incurring business disruptions 
of various degrees of severity simultaneously. Significant system failures within these organisations could 
leave SB without critical raw materials, access to customers or other necessary services supplied to us by 
outside parties whether or not these organisations are linked to us electronically. Because of the phenomenal 
information intensivity of modern day pharmaceutical research and manufacture, such problems could also 
slow or halt the development of new products. 


To address this threat we have initiated a global evaluation process designed to identify the Year 2000 
status of our important partners. We are also developing contingency plans to ensure business continuity and 
are prepared to take measures such as stock piling of key raw materials or qualification of back up suppliers, 
where prudent. 


Should disruptions occur we intend to use every remedy of law available to us, although we are much more 
interested in correcting and eliminating the risk beforehand, rather than attempting to ascertain blame and 
apportion damages after the fact. 


5. Do you think that the Government has done enough to raise awareness of the potential problems that may 
be caused by the millennium bug? Has it done enough to help field solutions to the problem? What more should 
be done? 


Ultimately, each organisation must be responsible for correcting its own systems. 


This being said, the pivotal role of Government cannot be ignored. The previous UK Government gave 
little leadership on this issue. We hope the new Government will play an important part in galvanising private 
sector companies as well as public bodies into action. A more aggressive monitoring of Year 2000 action 
programmes of government departments and agencies, for example, may well encourage other organisations 
to treat the issue with the seriousness it warrants. 


In terms of its own systems, portions of the UK Government (as is the case with the US Federal and State 
governments) have apparently failed to make adequate remedial plans. We are concerned that significant 
disruption will result because, even if the political will now exists, time is running out. 


There is no time left for debate, only action. 


1 December 1997 


APPENDIX 33 
Memorandum submitted by Coopers & Lybrand 


1. INTRODUCTION 


101. Coopers & Lybrand is a world wide based organisation which provides professional services including 
accounting and auditing, tax, management consulting and risk management. We were one of the first major 
professional firms to address the turn of the century date issue, setting up a specialised Year 2000 team to 
provide support to our customers in the management of the Year 2000 programme. In order to achieve that, 
Coopers & Lybrand has developed a structured but flexible approach specifically designed to address Year 
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2000 issues, based on our existing proven methodologies for managing large programmes. In addition we 
have initiated a major internal programme to ensure the Year 2000 compliance of our own systems. 


102. Insummary, Coopers & Lybrand is very concerned about the risks associated with the Year 2000 and 
the effectiveness of action which has already been taken, as well as the level of readiness and compliance of 
the systems. We are actively participatmg and working with different Y2K Interest Groups but with the time 
remaining there are still many organisations that have not yet started, especially small businesses. These are 
a significant concern. Of the organisations which have started, the majority should be able to inventory their 
systems and concentrate their efforts on fixing the critical ones. The Government’s activities, although well 
intentioned, have not been enough in terms of raising awareness and providing adequate funds. 


2. RESPONSE TO THE ISSUES 


201. This section sets out our responses to the specific questions raised in your letter of 3 November. 
Coopers & Lybrand believe that there is a very real risk associated with the inability to manage the date 
change in personal and mainframe computers, embedded systems and software, especially where such 
computers are performing safety critical operations. The risks include: 


— Process control failures, which could result in the stoppage of the process, safety implications or 
unexpected results. 


— Utilities failures, generating health and security risks. 


— Computer applications that use the date for computations, comparisons and sorting, producing 
incorrect results or failures due to invalid data. 


— Events being triggered out of sequence (eg security, backup/recovery, . . .). 


— Heating, ventilating, alarms and other embedded systems failures that could end in safety problems 
in either business or non-business buildings. 


— Financial systems calculating taxes or payments on a long term basis producing wrong results and 
other inconveniences that could end in court. 


— Financial institutions losing loans outstanding to organisations that may not survive. 


202. The “millennium bug” problem is a challenge without precedent. It is based in technology but 
ultimately is a business management problem that must be addressed. There are many things which a large 
company needs to do in order to complete a successful Year 2000 programme, including: 


— setting up a programme team with an appropriate structure for that specific organisation; 


— developing a communication programme to engage the total organisation in understanding and 
dealing with the problem; and 


— developing plans that not only deal with the technical challenges (hardware, software, embedded 
systems, etc) but cover funding and the organisation’s cultural issues. 


Internal politics cannot be allowed to get in the way of completion of the work, since the deadline is not 
negotiable. 


203. Two misconceptions about the Year 2000 problem should also be considered. The first is that the 
problem will be encountered at midnight on 31 December 1999: although this is largely true for computer 
equipment and embedded systems a high proportion of the application software on which businesses depend 
is used in some way to forecast future activity. This means that systems will start to fail well before the end 
of 1999, and possibly before the end of 1998 (some have already done so!). Consequently the time available 
in which to address the problem is considerably less than may be believed. 


204. The second misconception is that systems failures will be highly visible and easily identified. Again, 
this is true of many systems and likely failures, but there is an insidious danger that systems may appear to 
work correctly but will produce incorrect information on which key business decisions will be taken. This 
“invisible” failure may not be detected until well after the system has become unreliable. 


205. In discussing the effectiveness of action which has already been taken to avert the problems we would 
stress that although most large companies have started to evaluate the problem, few have reached the 
correction and test stage. Their plans and schedules show that, with the time remaining before the millenium 
roll-over and bearing in mind that several of the systems already have been or will be affected before the Year 
2000, most of these companies will not complete their programmes in time. Typically they will only manage 
to inventory and fix the most critical systems. 


206. A recent Coopers & Lybrand study of over three hundred UK based organisations with a turnover 
in excess of £100 million, across a number of market sectors, has shown that the information systems in over 
half of the organisations are not yet fully compliant. However, for the high proportion still in the process of 
correcting systems, “they soon, will be”. 


207. Additionally, we would add that experience has shown that an individual’s viewpoint concerning the 
Year 2000 problems moves through several stages: naiveté, denial, panic and realisation. The last stage occurs 
when people recognise that changes are not impossible. For that reason, it is important that the whole 
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organisation is aware of the problem. Those organisations that have already been through this process show 
they are in a better position to achieve compliance. 


208. One limitation on the action possible by most organisations is the dependency on third parties to 
provide compliant software. There are many examples of repeated delays in the provision of compliant 
software: customers may have little or no leverage with which to compel suppliers to deliver. Should software 
suppliers cease trading without providing compliant software, their customers will be in a difficult position 
with very little time left to effect a solution. 


209. Taskforce 2000 has done an excellent job in raising awareness in large organisations, but could have 
been far more effective if proper funding had been available. Coopers & Lybrand have been very supportive 
of any initiative which would not only arise awareness but also persuade organisations to start the programme 
of work to resolve the problem, playing an active role in the DTI road shows. 


210. Coopers & Lybrand also participate actively in the UK Y2K Interest Group, hosting and leading 
many Work Group meetings. Topics for such meetings have included IT Testing Strategy, Embedded 
Systems, Resourcing and Contingency Planning. Currently one of our consultants chairs the Utility Group, 
a sub-group of the Interest Group and, in this capacity, recently attended an Action 2000 meeting. 


211. Action 2000 is a somewhat belated, but welcome initiative by the Government to try to ensure the 

correct steps are being taken in the private sector to ensure compliance. However, there is now very little time 
left to start new ventures of this kind, and Action 2000 will need to be seen to be taking action very quickly, 
rather than just talking about it, if it is to carry any credibility in the marketplace. We have already had 
feedback from some clients that too long a gap has developed between the announcement of the initiative and 
anything actually happening. 
212. It is rumoured that Taskforce 2000 is to be wound down and that Robin Guernier will no longer be 
playing an active role. This would not, in our opinion, be a constructive move; Robin’s name is well known 
in the marketplace and we are sure could be used to great effect if the Taskforce were to be given a remit (and 
funds) to broaden its strategies from awareness to include other issues. 


213. One of the major problems with any initiative is the lack of co-ordination between all the different 
groups working to try to resolve the problem in the various market sectors. For some businesses whose 
operations span several sectors there is a real problem in trying to attend the various meetings and keep the 
programme running at the same time. We have often heard the view expressed that it would be very easy to 
become “professional conference-goers”’. 


214. We are aware that Action 2000 is currently trying to look at the various initiatives that are taking 
place, and indeed starting some new ones of their own. We feel that a truly valuable action would be to identify 
all the different User/Interest Groups for each market sector and to initiate the co-ordination of such groups 
so each topic “belongs” to a single group. If this is not possible, then at the very least the activities of each 
group should be identified and published so that the differences and similarities between them are clearly 
understood. 


215. We believe that the Government should be taking more co-ordinated and direct action to ensure that 
the Year 2000 does not impact the UK’s infrastructure—its utilities, communications, transport and 
healthcare—or that contingency plans are established (and published) to address any possible impact. 
Individual organisations may be able to ensure the Year 2000 compliance of their own systems but will still 
be severely damaged if there is no electricity to run their computers and buildings, no communications or if 
staff are unable to attend due to transport failures. 


216. There are a number of issues which are constraining the progress being made on the Year 2000 
problem. These constraints, discussed below, include: 


— lack of funds and/or suitable resources; 
— insufficient priority given to the problem; and 
— lack of testing capability. 


217. For many organisations the cost of addressing the Year 2000 problem represents a major constraint. 
No budget requirement has previously been identified and the work provides no perceived benefit in terms 
of business gain. 


_ 218. Resources are also an issue. There is a widely-reported shortage of technical resources such as 
programmers: perhaps more damaging, if less widely understood, is the lack of project management skills 
required to manage the Year 2000 work programme. 


219. Many organisations are guilty of giving insufficient priority to the Year 2000 problem. There are 
many business initiatives which offer greater perceived benefits, particularly where the Year 2000 is seen as 
a primarily technical problem. Other issues such as the proposed Economic and Monetary Union are also 
distracting attention from this problem. 


220. It is generally agreed that the most difficult and time-consuming aspect of Year 2000 compliance is 
testing. Even systems which are thought to be already compliant will require testing to make certain, while 
systems which are extensively modified to achieve compliance will need to be exhaustively tested not only for 
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compliance but to ensure that the modifications have not introduced errors into any part of their 
functionality. 


221. Most organisations are not particularly well equipped to undertake major testing programmes of this 
nature. There is a general lack of infrastructure to support testing, well-defined processes for planning and 
executing tests, and staff with specific skills and experience in testing. 


3 December 1997 


APPENDIX 34 
Memorandum submitted by The Electricity Pool of England and Wales 


INTRODUCTION 


1. This memorandum is in response to the request of 11 November by the Clerk to the Science and 
Technology Committee to furnish details of The Electricity Pool’s Year 2000 activities and progress together 
with comments on the contribution from Government initiatives. 


2. By way of introduction to the Pool and other parties referred to in the response: 


(i) The Electricity Pool was created in 1990 in readiness for electricity industry privatisation. It facilitates 
a competitive bidding process between generators that sets the wholesale price paid for electricity for 
each half hour period of every day. In addition the Electricity Pool provides the supporting financial 
settlement processes that calculate suppliers’ bills and ensure payment to generators. 


(ii) The Electricity Pool’s settlement processes have been developing to support the competitive market 
for supply to consumers—the ability to purchase their energy from a supplier other than their host 
regional electricity company. This option became available for customers with peak demand 
exceeding 1MW in 1990 and for more customers with peak demand exceeding 100kW in 1994. 
Finally, the option is planned to become available for all customers in 1998. 


(iii) The trading and governance arrangements under which the Pool operates are defined in a Pooling 
and Settlement Agreement to which all traders in the Pool are obliged to be signatories, as are other 
organisations providing some of the key services to the Electricity Pool. These include the 
Settlement System Administrator, a function presently outsourced to Energy Settlements and 
Information Services Ltd. 


3. This response relates only to the business of the Pool in facilitating and supporting trading between 
electricity generators and suppliers and does not reflect the status of individual Pool Members’ own wider 
Year 2000 issues. 


RESPONSE TO YEAR 2000 ISSUES 


3. Addressing Year 2000 issues as raised in the Science and Technology Committee’s Terms of Reference: 


(i) The Pool’s systems are not safety critical, nor could their failure be regarded as instrumental in any 
cessation of power services. Failure of a Pool system would at worst delay correct calculation and 
execution of payments from electricity suppliers to generators. 


(ii) Actions have been fully effective in identifying problem areas by determining the impact of the 
millennium change on software components within the direct control of the Pool, in the financing 
and definition of modifications required to ensure millennium-change compliance within such 
components and commencement of remedial measures. 


(iii) Government initiatives have not been instrumental in either raising awareness or assisting with 
solution of problems. Contact with Taskforce 2000 to debate solution approaches clarified that its 
objectives were not to help with solution but only to raise awareness. It is too early to comment on 
the efficacy of Action 2000. 


(iv) It has been a condition of acceptance of any new system in recent years that it be millennium 
compliant. 


(v) Contingency plans for failure in normal functioning of settlement processes are covered by part of 
the Pooling and Settlement Agreement. 


(vi) Compliance costs/liability were not allowed to delay progress with the above, but have already been 
resolved. As regards consequences of system failure, the Electricity Pool provides a service to the 


members who comprise it and fund all of its activities, so there are no legal implications in system 
failure within the Pool. 
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RESPONSE TO SPECIFIC QUESTIONS RAISED 


4. The following responses to the specific questions in the order in which they were raised: 


(i) Without appropriate corrective action, it became clear that the Settlement System would fail to 
function across the millennium-change and that fall-back processes as defined in the Pooling and 
Settlement Agreement would be required. 


(ii) Specific steps have included: 
— Formation of an Expert Group to focus on potential millennium change problems. 
— High Level, followed by Detailed Impact Analyses on the Settlement System. 


— Preparation of the Project Initiation Document by contractor, scheduling all corrective 
measures to be completed by September 1998. 


— Monitoring of progress with this and broader interactions will assure that the Pool’s systems 
will continue to function correctly across the change of millennium. 


(iii) Resources scheduled and expected to be available could conceivably become limiting. The Pool is 
constrained to consideration of assurances from service providers beyond the direct control of the 
Pool but upon which its Settlement System depends. 


(iv) Contingency plans form part of the Pooling & Settlement Agreement between Members which 
comprise the Pool. The Pool would have to operate these if the computerised support systems were 
to fail. Energy Settlements & Information Services Ltd has agreed to take responsibility for all 
necessary corrective measures. 


(v) Taskforce 2000 adequately raised widespread awareness of the potential problems from Year 2000 
anomalies. Government has not visibly contributed to the solution of the potential problems. 
Facilitation of Internet publication of experience of applying the range of corrective measures such 
as windowing, encapsulation etc (at open.gov.uk perhaps) would materially assist in solving the 
problem. A widespread understanding or at least appreciation of the technological approaches 
would encourage appropriate response to the real issues and reduce the risk of inappropriate 
response to any “hype”. 


CONCLUSION 


5. The Electricity Pool is confident that its plans and actions for removing potential anomalies across the 
change of millennium will reduce any risk of disruption to its settlement processes to the absolute minimum. 


4 December 1997 


APPENDIX 35 
Memorandum submitted by British Airways plc 


INTRODUCTION 


1. British Airways plc is a significant and long time user of computing equipment throughout its activities, 
and we have experience in managing the Year 2000 problem in the United Kingdom and abroad. 


2. In summary, British Airways believes that the Year 2000 problem is very serious, and is putting a high 
priority on managing it. We would like to see Government take a more active role in raising public awareness 
at home and abroad, and promoting the exchange of compliance information between organisations. 


What estimation has BA made of the seriousness of the“millennium bug” problem? 


3. British Airways considers the Year 2000 problem to be very serious. Without action, it would threaten 
the smooth operation of the airline, would cause disruption to passengers and consignments of cargo and 
could result in significant financial losses. The effects of the problem will extend to the air transport industry 
worldwide. 


4. In particular we recognise that this is not purely an issue for our internal computer systems but is a 
question of ensuring in good time the uninterrupted continuity of our business over the millennium period. 
We see that all of the organisations we are associated with on a world-wide basis—airports, air traffic control, 
utilities—must take the problem equally seriously to avoid disruption to the international aviation and its 
customers. 
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What steps have been taken. . .? 


5. British Airways started a project in its Information Management department in 1995. It has worked 
successfully with industry and other bodies (The International Air Transport Assocaition (IATA) and the 
British Standards Institution (BSI)) to help define technical standards that will ease the problem. Since the 
beginning of 1997, we have specified all new systems to be Year 2000 compliant, and all contracts have 
included Year 2000 clauses. We have now set internal standards so that all BA systems adopt a common 
approach to Year 2000 compliance. All applications, software, networks and hardware will be reviewed for 
compliance to the Year 2000 standard, and we will also review the compliance status of all supplied services. 
We intend to make any necessary changes within our own control by the end of December 1998. 


6. By November 1997, we had completed an inventory of all our information technology (IT) components. 
Over 85 per cent of these have been assessed in detail, and the correction project planned and scheduled. The 
remaining assessments will be completed by the end of 1997. Correction work is well under way in many cases. 


7. We estimate that we have done about 20 per cent of the work to date, with the bulk of the remaining 
work occurring between now and December 1998. 


8. Earlier this year BA also established a project board representing all departments to deal with the Year 
2000 issues from a wider business perspective—embedded chips, suppliers, local systems and processes with 
particular emphasis on our major business partners with whom we will work closely. The methodology for 
this project is to compile an inventory of systems, equipment, and suppliers along with a risk assessment. 
Action plans with timescales will then be developed to ensure continuity of business-critical items, along with 
contingency. plans. 


9. Pilot studies are being undertaken to refine this process and there will be quarterly reporting to the audit 
committee of the Board along with more frequent monitoring by Executive Directors. 


10. We are confident that we can reduce the problem level to something that can be handled: It is too early 
to say whether some level of problem will remain at the time of the millennium. 


What are the major constraints . . .? 


11. Within the purely IT part of the work, we believe that the major constraint will be our dependence on 
suppliers of software and services. Our experience so far is that few suppliers are prepared to warrant their 
products to be compliant, and we will need to take early decisions to substitute one supplier for another. A 
second constraint will be the complexity of the interrelationships between our many computer systems and 
also between them and those of our business partners. It will be impossible to carry out complete tests, and 
we must judge what parts need to be tested. 


12. In the wider business context our high degree of dependence on, and interrelations with, major service 
providers and suppliers will be a major focus of our activities. 


Have British Airways developed contingency plans .. .? 


13. British Airways has in place business contingency plans which provide for failures of all kinds including 
failures of computer systems. We intend to develop more specific plans over the next year as we understand 
more where the greatest threats to our business operation are. The allocation of responsibility would depend 
on the nature of any failure. 


Has the Government done enough to raise awareness/help to find solutions . . .? 


14. We believe that the Year 2000 problem will affect almost all aspects of society, with its potential to 
disrupt utilities, the banking industry, transport and communications. We think that government should do 
more to raise awareness, especially with smaller companies. It should also emphasise our dependence as a 
society on machinery that contains computer chips, and work to move the awareness on from obvious 
computer problems. 


15. There may be a role for a transport group under government leadership to co-ordinate efforts with 
regard to transport infrastructure issues in this country involving interested parties. 


16. For an international company operating in all parts of the world we believe there is a particular role 
for Government to use its influence with other governments and international organisations to ensure that 


all countries take this problem seriously and take action to deal with critical infrastructure problems which 
may be identified. 


December 1997 
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APPENDIX 36 
Memorandum Submitted by Marks and Spencer 


1. INTRODUCTION 


Marks and Spencer is a leading retailer. It uses computers extensively and is a computer dependent 
company. The main issues facing Marks and Spencer are computer equipment and applications that are date 
sensitive, and appliances, not normally regarded as IT that may have embedded chips that may or may not 
be date sensitive. This extends throughout our supply chain and into the retail operation. The committee 
should be able to judge from this submission, how Marks and Spencer, as a large organisation, is able to deal 
with the issues generated by Year 2000, and the progress made to date. We also hope that the committee might 
be able to use some of the experiences in this submission to help shape government attitude towards the 
problem and generate appropriate action. 


2. CENTRAL COMPUTER SYSTEMS 


Marks & Spencer is dependent upon its central or corporate computer systems, largely written in house. 
The business is predicated on accuracy in all these systems. The potential threat of disruption to its operation 
is serious. At worst key systems could stop, causing vital business processes to fail. This is most relevant to 
our Food business as the processing of Food sales and re-merchandising has very tight timescales. Less acute, 
date based calculations could become inaccurate giving incorrect stock positions, availability and response 
to sales. Least disruptive would be programs having cosmetic problems with dates on listings and reports. 
The potential threat of failure also exists on major pieces of hardware, system software and packages supplied 
to us by external IT companies. We are confident that we will be successful in dealing with these issues. 


3. REPLACEMENT SYSTEMS 


The IT Group is organised on business lines. Each area of IT has Project Managers responsible for making 
all necessary changes to computer systems. They report to a senior manager, who is responsible for progress 
overall on Year 2000 throughout Marks and Spencer. In some cases the business has capitalised on the need 
to change. One example is our New Point of Sale system, a major development that is fully Year 2000 
compliant, for which completion is planned in October 1999. This enhances the pressure to deliver this system 
in a timely manner. 


4. PROGRESS 


It is estimated that we will expend, in total, about 110 man years effort and about £6 million dealing with 
the problem. All areas have completed the analysis phase for Marks and Spencer programs and some coding 
is complete. In the next twelve months the remaining coding and all testing is planned. This is a challenging 
timetable. Until completion of testing in major business areas the company remains confident but cautious 
about computer problems that might be encountered at the millennium. 


5. USER PROGRAMS 


The greatest challenge to continuing sound business is the existence of user written programs, the majority 
of which are spreadsheets. Many business people within Marks and Spencer believe that the “millennium 
bug” is an IT problem and that users do not have to concern themselves with it. We must make business 
people aware that they have a responsibility for their own programs and will offer advice and guidance 
accordingly. 


6. EMBEDDED SYSTEMS 


There are other pieces of equipment that have chips, referred to as embedded systems. These include lifts, 
refrigeration units, time lock safes and production control systems. The chips may or may not have date 
sensitivity. An extensive list of non-computing equipment has been created. Options for dealing with the 
issues arising from this are currently being investigated. It is not certain that all can be tested. This will put 
pressure on resources necessary to fix problems when key dates around the new century arrive. 


7. SKILLS SHORTAGE 


Skilled computer and software people are in short supply in the IT industry. This will test our ability to 
retain our staff in a challenging time of system development and re-engineering. The date changes to systems 
are not in themselves challenging but are an enormous number of them. Shortage of experienced people 
represents a potential threat to our progress. We cannot further rely on third party development partners as 
they are indicating their ability to take on more Year 2000 work. 


192 APPENDICES TO THE MINUTES OF EVIDENCE TAKEN BEFORE 





8. CONTINGENCY PLANS 


There can be no specific contingency plans for system failure due to millennium problems. Problems will 
have to be fixed at the time when they arise. The business has no ability to return to a paper based 
environment. We must ensure that changes are done accurately and thoroughly tested. The millennium and 
Christmas 1999 coincide. This will be a peak trading period for us. Any failures will be more acutely felt. This 
holiday period will be different to a normal end of year and this will affect schedules more than usual. The 
business has normal contingency plans that are invoked in cases of failure and these would be exercised as 
appropriate. 


9. GOVERNMENT ACTION 


The subject of potential computer failure related to the change of year in 2000 is well publicised. The role 
of Taskforce 2000 has been effective in generating publicity on the likely results of such failure but has offered 
little advice on resolution of problems. It is too early to comment on the impact made by Action 2000. The 
combination of extra work generated by the new millennium, the short timescale for introduction of the Euro 
currency, irrespective of the UK position, and the general increase in the complexity of computer systems, has 
created a shortage of skilled labour in the IT industry. It might still be helpful for the government to consider 
incentives and training options to increase the pool of skilled labour. Although time is short, the government 
might consider taking swift action. 


10. TESTING OTHER DATES 


The millennium bug is seen as a single date problem. We are aware of, and will test for, other dates that 
could cause problems. These are: 


— 9 September 1999 (9999 is used extensively as a default in programming) 
— 29 February 2000 (2000 is a leap year unlike 1900 and 2100) 


Retail companies generate a lot of system changes. Year 2000 will necessitate a change freeze in the run up 
to the millennium in order to ensure stability of our computer systems during our peak trading period which, 
as explained in paragraph 8, inevitably is a time of heavy schedule change. 


11. SUPPLIERS 


We deal with a large number of suppliers and contractors as well as a long international supply chain, on 
whom we are dependent for merchandise and services. These companies vary from small to large, some with 
little IT systems and equipment, some with a great deal. We have been in contact with all of those with whom 
we deal directly, stressing the importance of the issue and urging them to take appropriate action. However, 
it should be noted that smaller companies have less ability to make the necessary changes. We are conscious 
that we cannot instruct them and must not put ourselves in the position of shadow directors of their 
companies. 


12. RESPONSIBILITIES WITHIN MARKS AND SPENCER 


It is the responsibility of the management of the business to deal with Year 2000 issues. In addition to this, 
the company’s Audit Committee, chaired by a non-executive Director, is kept informed of progress. The 
Information Technology Review Committee, which is a committee of the main Board, reviews this project 
on a regular basis. 


13. SUPPORT 


The turn of the millennium will be a cause for national celebration. For IT, related industries and all those 
involved in engineering it will be a time for heavy on-site presence. We must assume that some things will be 
missed and will need immediate correction. We know that some problems cannot be anticipated. It is essential 
that the trading and holiday pattern are set well ahead of time and that personal arrangements of those 
involved anticipate a need for on-site presence. 


10 December 1997 


APPENDIX 37 


Memorandum submitted by BG plc 


_ 1. This submission is made by BG ple, one of the two successor companies of British Gas ple following 
its demerger in February 1997. BG comprises three main businesses: Transco, the developer and operator of 
Britain’s gas transportation network which is regulated as a monopoly service provider to gas shippers and 
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suppliers; a substantial, mainly gas-related, Exploration and Production business which operates both in UK 
offshore waters and overseas; and a growing International Downstream gas business which is engaged in the 
development and supply of gas markets, principally in developing countries. 


INTRODUCTION 


2. BG ple welcomes the opportunity to provide a memorandum to the Science and Technology Committee 
on the Year 2000 and computer compliance. The Year 2000 computer date problem has been recognised by 
BG plc as a key business risk area and is regularly reviewed by the Executive Risk Management Committee. 


3. BG plc intends to be ready for the Year 2000 and so plans are designed to ensure the discovery and 
completion of the majority of Year 2000 work by the end of 1998, leaving 1999 for final “mopping up” and 
testing. As with other companies facing this problem, this is an ongoing programme of work and these 
timescales reflect current plans. 


4. Whilst the programme is being monitored and supported at the Group level, BG believes that the issue 
is fundamentally a matter for each of its Business Unit Management Teams. They are the only groups able 
to properly assess the business risk as the solutions will not always be IT ones. Many uses of date are 
effectively “passive” and will have little effect on system fundamentals. BG is concentrating its remedial action 
on the fundamental uses of date in either operating systems or application systems which would cause 
significant business impacts. In addition, BG needs to address the use of date in computer chips, both in 
normal computing equipment, such as PCs, and also in process control equipment. 


5. BGhas identified two major areas of activity as regards Year 2000 compliance: business computing and 
process control computing (affecting the operation of our pipelines, power stations and E&P operations). The 
safety and security of these latter operations are by far BG’s greatest concern and this matter is taken very 
seriously, both within Transco and within all international operations. BG is also linking with key industry 
bodies, such as the UK Offshore Operators Association (UKOOA), terminal operators and shippers, 
Regulatory Authorities and other vital utilities. 


6. The successful addressing of these issues involves not only BG itself, but also BG’s business partners 
and supply chain partners. BG’s approach to this is for suppliers and business partners to demonstrate their 
plans and for BG to undertake an assurance process. Whilst mindful of the legal implications, BG’s approach 
is, above all, practical. 


7. In terms of business computing, BG is perhaps more fortunate than many in that the restructuring of 
the gas business and the recent growth of competition in the gas market, have resulted in BG having fewer 
legacy systems of ancient design. This means that, although some of these systems need attention, they are 
fundamentally better documented and able to be adjusted. 


8. Like many other companies, BG’s approach to business computing has been a combination of existing 
systems with the bringing forward of system replacement or modification to address the Year 2000 problem. 


9. Although there is increasing awareness of the problem, BG detects a lack of focus on the key issues. In 
particular, the support of small and medium-sized enterprises, through either relevant trade associations or 
other DTI industry links, may need to be strengthened and focused on the practical issues affecting them. The 
complexity of supply chain relationships means that no business is truly stand-alone and the effective support 
of the smaller and medium size business will be critical to all. 


THE SERIOUSNESS OF THE PROBLEM 


10. The problem affects application code (particularly of the older systems), operating systems, databases 
and embedded chips, not only in obviously computer equipment, but in a whole range of devices. Of 
particular concern to BG, is the use of such technology in process control equipment affecting our 
fundamental operations. BG’s first responsibility is to ensure the safety and security of the national gas 
transmission and distribution system. Thereafter, the other business risks, in terms of loss of income or 
business process capability, are important but less so than our process operations. Each business unit of BG 
ple will have in place, by the end of the year, an action plan to address the issues. Transco, in particular, is 
at an advanced stage in this. Progress is regularly monitored, at Executive level, by our Executive Risk 
Management Committee. 


ACTION STEPS 


11. BG’s planning work commenced in early 1997 and all business units now have designated managers 
responsible for this process, who are supported by a cross-business network and Executive level monitoring. 
The aim is to achieve most of the work during 1998 to ensure that appropriate testing can be completed in 
1999. Some work in the process control area may have to be undertaken during the summers of 1998 and 
1999 so as to avoid any impact on the operation of the gas network. BG is confident of its ability to have 
everything in readiness to address the business risk, but this does not imply that all problems will have been 
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resolved. In fact, in some cases, it would not be cost-effective or appropriate to produce an IT solution when 
a manual “work around” could be produced. 


12. BG is also working actively with suppliers and business partners to ensure that they also have all the 
steps in place to address the Year 2000 issue. It is encouraging that industry bodies are beginning to co-operate 
and provide networking opportunities. Companies are often willing to share experiences to mutual benefit. 


13. Perhaps the most difficult problem is that of the embedded microchip in computing or other 
equipment. It is often only by inspection of the particular chip that the likelihood of problems arising can be 
ascertained. Unfortunately, stock control in many computer suppliers has not been sufficiently good for them 
to be able to determine which chips went into which products. 


MAJOR CONSTRAINTS 


14. Whilst the Year 2000 problem will divert resources from meeting normal business needs, BG is 
confident that it can address the issues. However, similar organisations may be less fortunate and may need 
assistance in order to focus on the key issues. 


CONTINGENCIES 


15. BG sees the Millennium problem as a particular example of normal business continuity plans to deal 
with emergencies. In this regard, BG’s pipeline and other gas and oil operations are designed to “fail safe” and 
all reasonable steps are being taken to validate this approach. Systematic plans are in place to both address all 
of the key process issues and to deal with contingencies as they arise. 


16. In business computing, the areas of greatest anxiety are the operating systems and embedded chips 
which might cause the application systems to fail, even if the application systems themselves are not directly 
affected by the problem. 


26 November 1997 


APPENDIX 38 


Letter to the Clerk of the Committee from Mr R Hammond, Millennium Assurance Project Manager, 
HM Customs and Excise 


Please find enclosed eighteen copies of a memorandum prepared by the Millennium Assurance Project 
Team on behalf of HM Customs and Excise for the Year 2000 inquiry by the Science and Technology 
Committee. 


The view represented is that of the Millennium Assurance Project Team and has focused on how the Year 
2000 Date Change Problem may affect the Department, and our experiences to date. 


If there are any questions or areas of clarification required, please do not hesitate to contact me. 
10 December 1997 


Memorandum submitted by HM Customs and Excise 


INTRODUCTION 


1. HM Customs and Excise has had a project in place to deal with the Year 2000 potential computer 
problems since July 1996 although issues had started to be addressed before then. Potential problem areas 
have already been identified and work started to develop necessary fixes. The Millennium Assurance Project 
(MAP) deals with the correction and assurance of internal IS systems, the assurance of embedded processing 
and is helping to minimise any potential impacts on revenue collection by raising awareness within the 
business community. 


_ 2. Within this memorandum only those considerations which directly affect HM Customs and Excise and 
its business functions have been considered. References to any likely effects are constrained within a HM 
Customs and Excise framework. 


NATURE, MAGNITUDE AND IMPLICATIONS OF INABILITY TO MANAGE DATE CHANGE 


3. Aswith all organisations, the impact of an incorrectly managed date change on HM Customs and Excise 
could be considerable. The likely problems fall into three broad areas; embedded systems, computer systems 
and businesses’ systems. However, the Project has at all times stressed the importance of this being a business 


ras not an IT one. Any ill-effects will impinge upon an organisations’ ability to continue its business 
unctions. 


THE SCIENCE AND TECHNOLOGY COMMITTEE 195 





4. The likely effect on embedded systems could include disruption to, or failure of, building heating 
systems, building management systems, building security systems and devices which use date processing eg, 
video recorders, radios etc. As well as health and safety concerns, the ability of staff to physically gain access 
to their working environment could be affected. 


5. National computer systems could fail resulting in loss of revenue accounting systems and tax assessment 
systems, loss of trade statistic systems and customs import/export processing. In addition, local systems which 
perform business support functions could be affected. 


6. If businesses’ accounting systems are non compliant, the revenue stream, whilst not being stopped as 
revenue would still be collected, would suffer a short term delay, and more Departmental resource would need 
to be expended to collect and assure this. In addition, businesses need to be compliant to continue into the 
next century and to avoid the embarrassment of failure. 


7. Thus, the potential of a badly managed and non-compliant date change could be considerable to the 
Department and in turn could threaten Government revenue collection. 


EFFECTIVENESS OF ACTION TAKEN 


8. HM Customs and Excise has had a project in place to deal with the Millennium date change problem 
since 1996. It is project managed from within the Information Systems Directorate reporting to a Project 
Board representing all Departmental regimes. Each specific regional area (Collection) and HQ discipline has 
its own sub-project in place reporting to the Project Manager. To date, approximately 40 per cent of the work 
required to achieve Year 2000 Compliance has been completed. 


9. All areas which may be affected by the date change have been covered in the project. The Department 
submitted plans to the Central IT Unit of the Cabinet Office in October 1997 as requested. 


10. The Department has inserted a “Year 2000 Clause” in all new contracts let, based on the DISC 
PD2000-1 A definition of Year 2000 Compliance (British Standards Institution) definition of compliance. To 
date, no instances of suppliers who are unwilling or unable to agree to this have been recorded. The task of 
seeking compliance statements for existing systems is more complex and lengthy. Suppliers either 
procrastinate or claim compliance can only be achieved by an upgrade to the most recent 
version/specification. HM Customs and Excise has rigidly set in place a policy of refusing to pay for (solely) 
year 2000 upgrades. This is rigorously enforced across all suppliers. 


ROLE OF GOVERNMENT IN RAISING AWARENESS 


11. The view of the Project Board is that the “Millennium” should be tackled as a “UK PLC” issue, with 
a central drive from the DTI. Taskforce 2000 did some valuable work to raise awareness but the impression 
gained was that it centred on large corporations and tended to use scare tactics. As yet, the Department has 
not made any contact with Action 2000, although may do so to ensure that our own publicity campaign 
dovetails with the national initiative. In our view, the small and medium sized enterprises need to be made 
aware of their inherent obligations and need for compliance to ensure their own survival. 


DEVELOPMENT OF CONTINGENCY PLANS 


12. The view of the Project is that Year 2000 contingency plans are included within any standard 
contingency planning/disaster recovery scheme. Failure at Year 2000 and the potential consequences are the 
same as serious fire at a computer centre for example, albeit at every location at once. Disaster recovery 
planning is already in place for central IT systems and a review of local plans has recently been commissioned. 
Local sub-project managers are being ensuring these are sufficient to meet the potential of the Year 2000 
problem. 


LEGAL IMPLICATIONS 


13. To date we have experienced no legal problems. 


ESTIMATION OF SERIOUSNESS OF “MILLENNIUM BUG” IN HM CusTOMS AND EXCISE 


14. The Department is tackling the Year 2000 problem in a serious although risk based manner. To this 
end, financial modelling of the potential revenue risks is being considered. 


15. In its entirety, the Year 2000 date change problem is manageable within HM Customs and Excise 
which is well practised in dealing with change. Its seriousness is indicated by the personal interest the 
Chairman and Board of Customs and Excise are taking in the issue. 
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WorK UNDERTAKEN TO DATE 


16. Work has been progressing in the three areas identified in paragraph 3 and is broadly on target for 
completion of all compliance work by December 1998. National Computer systems and services which are 
maintained by a central IT Division are being corrected and tested in conjunction with the service owners. 
Despite one or two specific problems, work is progressing well. The IT infrastructure within the Department, 
currently the subject of a PFI exercise, is being made compliant. Local systems are being checked by the local 
IT teams. Business support equipment including telephones, faxes, etc and building services are being checked 
for compliance. These are being made compliant where necessary. 


17. A separate working group dealing with business compliance issues has been formed and meets 
regularly to review progress. Its specific responsibilities are publicity to ensure businesses address Year 2000 
in order to meet their legal obligations and ensuring a consistent line on compliance across all 
Departmental regimes. 


IDENTIFIED RISKS 


18. The project has, in its risk register, identified two potentially serious constraints; lack of resources and 
dependence upon external suppliers. 


19. With no additional funding being made available for Year 2000 compliance work, resourcing remains 
tight for all the areas being considered. In some areas, sufficient resources are not available and contingency 
measures are having to be taken to ensure millennium compliance activity is completed. The potential of an 
increasing attrition rate due to high pay rates in the commercial sector is a serious concern and has been 
recognised with the majority of development work planned for completion in advance of the Treasury target 
date of December 1998. ; 


20. The Department is highly dependent upon external suppliers; both those with whom a partnership 
exists and those with whom a contractual relationship exists. In both cases much informtion needs to be 
obtained from them, assessed and disseminated to ensure compliance. In general, the trade has been slow to 
provide information regarding their systems which will help identify potential non-compliance areas. This 
may be due to reluctance to be the first in a particular industry sector to make such statements and thereby 
go out on a limb. Notably the Department has achieved significant success with the strategic PC suppliers 
who have provided upgrades for all platforms some dating back over five years at no cost. Providing 
negotiations are handled with care suppliers are willing to assist in solving the “joint” problems. 


10 December 1997 


APPENDIX 39 
Memorandum Submitted by The Computer Futures Group 


INTRODUCTION 


1. As the leading supplier of permanent IT staff in the UK, the Computer Futures Group is well placed to 
comment on the extent of the problems faced by UK Plc as a result of the affects of non-compliance of 
computers with the Year 2000 date change. 


2. The Computer Futures Group is also one of the leading suppliers of IT contract staff and has the UK’s 
largest database of IT consultants and engineers. 


REPORT 


In Reply to: The legal implications of disputes over liability for compliance costs and system and program failures 


3. The legal implications of disputes over liability for compliance costs and system and program failures 
is one of the crucial issues for UK industry. Many companies are finding that non-compliance with the year 
2000 date change is already affecting their business as they look to plan beyond the millennium. The effect of 
non-compliance will be felt down the chain of suppliers, and therefore the issue cannot be tackled in isolation. 
A company may have completed the necessary changes to the computer system, but will still be faced with 
the same crisis if suppliers do not follow suit, and many will not as the cost of compliance will be too great. 


4. The same issue applies to system providers. System providers range from one person companies to 
giants like Microsoft, with many having only one product. The cost of making their products millennium 
compliant is often too great, although most IT companies are claiming their systems are Year 2000 compliant, 
they do so in the full knowledge that they are not. On the Millennium change those systems will fail and the 
providing company will be trading to avoid the cost of amending their systems and any legal obligations. 
These service providers will then start-up new ventures which will have the only expertise to fix the failed 
systems. Whilst the clients will be extremely unhappy about this, they will have no choice but to pay up the 
smaller amount of repairing the system rather than installing a whole new package. 
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5. The current rate of bankruptcies for software firms is very high. They require quite low start-up costs 
and new companies can quickly be formed again on the foundations of the former firm. If this issue is not 
tackled soon then the new millennium will see a hugh growth in “phoenix” computing companies, which will 
have a serious impact on the UK industry. 


6. One of the key areas of enquiry for the new Government funded body, Action 2000, should be into the 
compliance of existing IT packages which are being sold to companies as millennium complaint. If system 
providers are not forced to ensure their products are fully complaint, UK companies will be faced with 
complete system failure and a large repair bill on the millennium date change, with little legal redress. We 
would also encourage the Committee to look into current insolvency legislation, and ensure that any loop 
holes currently being exploited by computer software operators are closed before the new millennium. 


11 December 1997 


APPENDIX 40 
Memorandum submitted by the Inland Revenue 


BACKGROUND 


The potential effects on computer systems of the so-called “Year 2000 problem” have been well understood 
by the Inland Revenue for some time. As a major government department whose core business depends 
critically on effective IT support, we are committed to taking effective action to ensure that we can continue 
to assess and collect tax revenues without problems after 1999. 


Accordingly, we, together with EDS, our information technology partners, embarked on work in early 
1996 to tackle the Year 2000 problem for the IT systems which support our business. That work began with 
a thorough investigation of the problem, leading to a comprehensive report from EDS in November 1996 
on the work and the resources needed to make our systems fully “Year 2000 compliant” within a planned 
timeframe. 


PROJECT APPROVAL AND RESOURCING 


The subsequent project was authorised by a sub-committee of the Revenue’s Departmental Management 
Board at an estimated overall cost of £26 million, the main element of which is the manpower cost of carrying 
out the necessary software conversion and testing work. Also included in that figure are the associated 
operational and hardware costs. To ensure that we can meet these costs from existing PES provision, we have 
reprioritised other project work and system maintenance budgets. In July this year, we concluded a fixed- 
price deal with EDS covering the technical manpower costs required for Year 2000 work, in place of the input 
basis of payment which normally applies under the contract with them. The aim was to bring greater control 
and certainty to this major area of project expenditure where the risk of escalating costs could otherwise be 
significant. 


PLANNING AND REPORTING 


The Inland Revenue’s Year 2000 project covers nearly 250 of the IT systems which support different aspects 
of our business, plus our PC hardware and software estate. It has been given the highest priority by the 
Department: it is sponsored by the Deputy Director of the Business and Management Services Division who 
reports on progress each quarter to the Management Board sub-committee mentioned above. 


The Year 2000 project team have drawn up detailed project implementation plans covering, inter alia, key 
activities and milestones, risk management, scope and change control, communications and financial 
management. They are also actively addressing a number of issues central to project success: these include 
maintaining a problem-free exchange of data with certain external organisations (chiefly financial institutions 
and employers) through our electronic “interfaces” with them, and validating the various commercial 
hardware and software products on which a number of our systems depend. 


Copies of our main plans were submitted to CCTA in October 1997 (with updated versions in November) 
in accordance with the Chancellor of the Duchy of Lancaster’s letter of 21 May to Ministerial colleagues. 


PROGRESS SO FAR 


A full programme of software conversion and testing for all our affected systems is now well under way to 
a planned timetable. These changes are being implemented in a cost-effective way with minimal direct impact 
upon users’ day-to-day business or our service to the taxpayer population. Thirty-three of our systems have 
been made “Year 2000 compliant” already, and work on many more—including our major national tax 
assessment and collection systems—is well advanced. All essential conversion work is currently on target for 
completion by October 1998, and all testing work by Summer 1999. 


198 APPENDICES TO THE MINUTES OF EVIDENCE TAKEN BEFORE 





EMBEDDED MICROCHIP INFRASTRUCTURE 


The other main area of our Year 2000 work—the so-called “embedded chip technology” (ie, the 
microprocessors which control buildings security and access systems, office equipment etc)—is being 
addressed through a separate Departmental Year 2000 Interest Group who will be advising and coordinating 
the work of local managers in tackling the problem through their business continuity plans. 

December 1997 


APPENDIX 41 
Memorandum submitted by the Royal Academy of Engineering 


NOTE 


The Royal Academy of Engineering comprises the United Kingdom’s most eminent engineers of all 
disciplines. The Academy’s objectives may be summarised as the pursuit, encouragement and maintenance 
of excellence in the whole field of engineering to promote the advancement of the science, art and practice of 
engineering for the benefit of the public. The Academy aims to take advantage of the wealth of engineering 
knowledge and experience that its Fellows possess. The interdisciplinary character of The Academy’s 
membership provides a unique breadth of expertise with which to further all forms of engineering. 


By promoting a multi-disciplinary approach, The Academy is able to overcome traditional barriers and to 
demonstrate the interdependence of different areas of expertise in the efficient use of modern technology and 
engineering. Emphasis is also placed on the importance of well informed communication between engineers, 
Government, research establishments, industry, public services and academia. 


The evidence which follows represents a collation of personal views from Fellows of The Royal Academy 
of Engineering. It cannot reflect the views of all contributing Fellows nor those of The Academy as a whole. 
It may, however, be regarded as representative. 


1. What is your estimate of the seriousness of the millennium bug problem? 


Fellows of The Royal Academy of Engineering believe that the millennium bug problem is very serious 
and will affect mainframe computers, personal computers and potentially any equipment that contains an 
embedded microprocessor or special purpose chip. It is likely that particular difficulties will be experienced 
with systems over five years old. The problem is likely to have greatest impact on traditional data processing 
activities such as order processing, finance, payroll and pension administration. This appears to be widely 
recognised but is difficult to deal with because of the lack of detailed documentation on such systems coupled 
with a shortage of suitably qualified IT personnel to resolve the problems. 


A more detailed description of the problem is given in Annex A but, in summary, the difficult and time- 
consuming tasks faced by most companies are as follows: 


— Creating a full index of all system and application software used. 


— Addressing the problem of embedded software eg intelligent instruments with built-in chips which 
might use the year for data compaction etc. (This could be the most serious and intractable 
problem.) 


— Addressing the potential for corruption of all of these systems at or before the 1999-2000 date 
change. 


— Correcting or replacing the affected packages in the appropriate timescale. 


Estimates by others suggest that the cost of overcoming the problem will be greater than £400 billion world- 
wide and £30 billion in the UK, with possibly 10 per cent of companies failing as a result. Such estimates are 
difficult to prove but are believed to be indicative of the scale of the problem. 


Today’s business is part of a complex network of suppliers and customers with mutual dependencies. The 
continuous functioning of the business therefore not only depends on a particular company’s actions, but also 
on the actions taken by its business partners (including public services). To a great extent the millennium bug 
issue is perceived at present as a technology issue to be solved by IT personnel. The potential risks of failure, 
however, are business risks for which management is responsible. The problem has the potential to put many 
organisations out of business as their mission-critical systems, or those of their partners or suppliers, fail. It 
is essential that all parties address this issue adequately and urgently. 


Fellows believe that despite an insufficiency of time, money, knowledge and human resources to fix all the 
problems, it ought still to be possible to correct, or otherwise mitigate the most business-critical problems. 
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2. To what extent do you think that UK businesses and other organisations have done, or will have done, enough 
to avert any potential problems? 


It appears that UK industries and other organisations—professional institutes, consultants and some 
Government bodies, have done a lot to raise awareness of the problem. It is, however, unlikely that this could 
ever be enough to “avert any potential problem”. Some industries have an enormous amount of IT specific 
work to do, with a threatened shortage of skilled resources. Other industries are slow to assess the 
pervasiveness of the problem and its impact and are finding it difficult to get expert help. 


It seems likely that most larger companies with separate IT departments and IT budgets will, in many cases, 
have already allocated budgets to the millennium bug problem. However, many SMEs will not possess a 
separate IT department nor an explicit IT budget. There is some concern that such companies are also likely 
to have many other financial commitments that may result in the millennium bug problem being considered 
a low priority issue. 


The UK and USA appear to be ahead of the world in preparing for the Year 2000. It is therefore likely 
that international systems will be more vulnerable than domestic systems. In considering the millennium bug, 
serious consideration must be given to understanding how the impact on one business affects other businesses. 


3. Do you think that the Government has done enough to raise awareness of the problems associated with the 
date change or to encourage action to avert problems? What more should be done? 


There is a view that, although the Government has done a lot to address the problem, more could be done 
to increase awareness of the issue in general. Taskforce 2000 was set up to provide news-sheet information 
and shared learning, partly funded by the Government. This group seems to have the correct membership 
but its role should now be focused on the wider business issues—legal, contractual, procurement, trading, 
risk assessment and contingency. There is concern that, to date, the emphasis has been on private companies 
and that more attention and support should be given to the public sector. There has also been criticism, 
however, that the Government has done little to support this group directly. More recently an industry liaison 
group, Action 2000, was set up which appears to have more direct support from Government and could be 
effective if adequate funding is provided. 


If Government departments and other larger organisations put more pressure on their own suppliers, this 
may help to ensure that the importance of the message is distributed to those organisations further down the 
supply chain who are potentially at risk. Significant resources need to be directed at testing and collating 
results. This is an area where a centralised body could aid efficiency in disseminating information for standard 
commercial products. High priority should also be given to ensuring that the utility companies have 
addressed this issue, possibly through the appropriate regulators. 


To prevent paralysis or extensive legal proceedings which could arise, the Government should examine the 
question of defining responsibilities both on the part of the customer and supplier, for funding and resolving 
Year 2000 issues, where no specific terms relating to this issue are covered in the contract. This may require 
changes in legislation. It has been suggested that Government should oblige suppliers to state whether new 
equipment is or is not Year 2000 compliant. Greater publicity could be given to examples of known 
deficiencies relevant to small and medium sized businesses which would make it clear how the problems arise 
and what checks need to be made. Initiatives which would enable companies to learn from the experiences 
of others would be particularly welcome. 


4. What, if any, are the major constraints militating against progress being made towards identifying and 
applying solutions to prevent computer systems and software failures at the millennium? 


The major constraints appear to be: 
— the still limited general awareness of the scale of the problem and general inertia; 
— a lack of understanding of the problem and a tendency to dismiss the problem as “just IT” when it 


is a business problem and business priorities must be used to determine the order in which systems 
are corrected; 


— ashortage of staff with appropriate IT skills and the immediacy of the problem; 

— the lack of financial resources for investment in replacement computers and systems, particularly 
in small companies; and 

— the pervasive hidden nature of the problem and the difficulty in identifying which equipment and 
systems are affected. 


Cost does appear to be a major constraint. Companies may have to divert significant funds towards this 
problem instead of towards profitable new products. Funding in the order of 10 per cent of development costs 
for the next few years has been suggested by one company. 


One major obstacle to identifying and applying solutions exists where there is no relationship, or where the 
relationship has been lost between, the supplier of the software and the user. This will apply equally to 
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software products intended for operation in a general purpose computer as well as for software products 
contained within embedded hardware. 


It has also been suggested that one of the major constraints is a fear of being sued. Suppliers may be 
generally reluctant to release information on product status because they fear litigation if these interim 
statements turn out to be inaccurate. Waiting until a cast-iron guarantee can be given will obviously introduce 
significant delays. 


Annex A 


THE MILLENNIUM BUG PROBLEM 


To estimate the extent of the problem, it is easier to divide the problem into two sub-problems: 
1. the clock roll-over problem; and 
2. the database problem. 
We should also divide the computers that will be affected into two different types: 
— General purpose systems (for instance PCs, mini computers etc); and 
— Embedded systems. 


1. THE CLocK ROLL-OVER PROBLEM 


The clock roll-over problems occur as a result of the clock going from: 
23:59:59 31/12/99 to 00:00:00 1/1/00 
The effect on general purpose systems is likely to be minimal: 
(i) few general purpose computers will be operating at midnight on a public holiday; 


(ii) the operating system normally deals with clock operations. As the operating system is software that 
tends to be in use in very large numbers, the developers have a strong commercial imperative to 
ensure that their current operating system deals with the clock roll-over correctly (in some cases, 
the developers may also support previous versions); 


(ili) commercial users of general purpose computers will often use the most up-to-date operating system 
to ensure that they are supported by the operating system developer; 


(iv) applications which require access to the clock will normally do so through operating system support 
(for absolute timing) or through standard programming libraries (for measuring time periods). Like 
operating systems, vendors of programming libraries will have financial reasons for ensuring that 
they deal with Y2K problems correctly. However, application programs that have been developed 
using previous version of programming libraries may suffer. It will be hard to determine which 
version of a programming library that a program was linked with (it may even be difficult to 
determine which library developer was used), unless the application developer maintains excellent 
records as part of his development process; 


(v) the effects of an incorrectly operating clock are likely to be minor and fixable. For instance, if a 
database program starts putting negative time stamps on data records, it will in many cases be 
possible to detect this, and to re-compute the correct time on a post-hoc basis. 


On embedded systems problems are more likely, and more serious: 


(i) it is common for embedded systems to make use of unusual hardware or hardware configurations. 
This requires that developers produce their own operating systems/executives to deal with clock 
handling. Thus the risk that the system does not handle the Y2K exists for large numbers of systems 
independently; 


(ii) application access to the clock will be through custom routines developed for a specific product, or 
through direct access to the clock hardware. This implies that every, different embedded system 
should be checked for Y2K compliance; 


(iii) embedded systems include many systems that are required to have 24 hour, 365 day operations, and 
therefore will be operating when the roll-over takes place; 


(iv) the effects of an incorrectly operating clock would be serious. Self-test routines checking system 
integrity may decide that the clock roll-over corresponds to a fault, and shut the system down, or 
worse, the fault may not be detected, which results in the system supplying negative times to 
applications. 


It is difficult to estimate the scale of the problem. Embedded systems are very pervasive, although of those 


which include real-time clocks, even those which monitor day and month, very few require that the year be 
entered. 


By 2/ 1/00, virtually all of the effects of the clock roll-over problem should have been dealt with (although 
the magnitude of those effects may be large in some cases). 
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2. THE DATABASE PROBLEM 


This problem has the potential to be a longer-lasting problem, with effects continuing to occur long after 
the start of the millennium. As an extreme example, problems might not be seen until people born after 
1/1/2000 apply for driving licences, or even when they start to retire. 


Database problems (ie problems arising from representing the year with two digits in databases) are likely 
to affect many specific applications on general purpose machines (particularly legacy applications), but also 
will affect some embedded systems, particularly larger ones which include logging and reporting functions. 


Other problems may occur through the synergy of “Y2K compliant” systems that have been fixed in 
different ways. For instance consider two interacting systems: one of which uses four digits, the other uses 
two digits together with some additional field to indicate whether the date is before or after Y2K. The systems 
work fine until data is exchanged between them (perhaps automatically). 


December 1997 


APPENDIX 42 
Memorandum submitted by the Civil Aviation Authority 


1. INTRODUCTION 


1.1 The Civil Aviation Authority (CAA) plays a leading role in the development of the aviation industry, 
through the safety and economic regulation of the UK aviation industry and by providing air traffic control 
and other air navigation services through a subsidiary company—National Air Traffic Services Ltd (NATS). 


1.2 The CAA and NATS regard the Year 2000 threat as a serious business issue because: 


— it could disrupt the operational air traffic control service with potential implications for airline 
operators and a more general knock-on impact on the UK economy; 


— it could represent a safety hazard to all forms of aviation activity including but not limited to 
services provided by CAA/NATS; and 


— it could disrupt the normal internal business activities conducted by CAA/NATS including IT 
systems concerned with e.g. finance, payroll, forecasting, business administration etc. 


1.3 The component parts of the CAA have all initiated Year 2000 projects with particular emphasis as 
follows: 


National Air Traffic Services Ltd: NATS’ objective is to provide a “service as usual” operation 
during the transition from 1999 to 2000. NATS has a total of some 700 equipment systems in 
operation and all are in the process of being assessed and corrected where necessary. No problems 
have been found which are technically insurmountable and NATS is confident that all necessary 
remedial action can be completed in good time. NATS has also actively promoted the Year 2000 
issue with other ATC service providers in Europe and the North Atlantic and with airline operators. 
NATS has a substantial installed base of non-operational IT systems (some 3,000 users) and needs 
to ensure that the IT infrastructure and applications are Year 2000 compliant. 


Safety Regulation Group (SRG): SRG sets and maintains UK civil aviation safety standards and 
its key concern is to highlight the Year 2000 issue to those organisations which it regulates. 
Manufacturers of airborne systems and equipment, with the potential to be affected by the Year 
2000 problem, have been asked to provide assurance that there can be no condition that could result 
in a hazardous effect on aircraft. In parallel, the Society of British Aerospace Companies Ltd 
(SBAC) have agreed to advise their members to provide a similar assurance. 


Economic Regulation Group (ERG): ERG regulates airlines, air travel organisers and airports. The 
main issue for ERG is the need to ensure that its internal IT systems are Year 2000 compliant. 


CAA Corporate Headquarters has standard IT systems which are run on CAA’s behalf by NATS 
using an external IT service provider. The Year 2000 compliance issue for the IT infrastructure is 
the same as for NATS. 


1.4 From a governance viewpoint, both the CAA and NATS Boards have taken active steps to ensure that 
the Year 2000 issue is being fully covered by all parts of the organisation. The individual Year 2000 projects 
are co-ordinated through a CAA Year 2000 Liaison Working Group and progress is subject to regular review 
by the respective Boards. 
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2. RESPONSE TO ISSUES RAISED IN THE TERMS OF REFERENCE 


The nature of the Year 2000 problem, its magnitude and implications, especially where computers are performing 
safety critical operations. 


2.1 The delivery of air traffic control (ATC) and other air navigation services is dependent on the collection 
and presentation of information to air traffic controllers, and the delivery of information and instructions to 
aircraft. The systems used by NATS range from radar sensors, real-time processing, voice and data 
communications, conventional information processing and display systems. Similarly, modern aircraft rely 
on computers for control and for flight management. The Year 2000 date change problem poses a potential 
threat to any situation where time/date information is a factor. 


2.2 The significance of the Year 2000 threat can perhaps best be illustrated by considering what would be 
the impact on the air traffic service if nothing were done to address the problem. NATS own assessment of 
a do nothing scenario is that: 


— voice communications and radar systems would continue to run but with inaccuracies evident in the 
date and time stamping of events and the display of some data to controllers. System safety would be 
maintained but the anomalous behaviour of systems might render normal operations unviable; 


— flight data and support information systems would experience time/date problems including the 
possible failure of some components. As a consequence of these problems it is probable that the 
normal ATC service would need to be closed down soon after the midnight boundary; and 


— data communications systems would also be substantially at risk, probably not immediately but 
under restart and recovery conditions. ; 


2.3 It is clear that the Year 2000 problem is pervasive, affecting many systems and requiring extensive 
assessment, correction, test and validation work to eliminate the threat. The assessment phase has been 
completed and, of the 700 operational systems deployed by NATS, it is evident that 75 require remedial work 
involving a mixture of corrective and replacement action. The estimated cost of this remedial work is £7 
million, divided between internal effort and external procurement. The total cost for CAA systems as a whole 
is £10 million. The work is scheduled for completion by July this year, to be followed by validation testing. 


2.4 One further key aspect of the Year 2000 threat is the dependence of NATS on its own suppliers, 
particularly telecommunications service providers, and on neighbouring ATC organisations. NATS has 
actively pursued a dialogue with its suppliers and customers. NATS has also promoted the Year 2000 issue 
with its colleague ATC organisations via Eurocontrol and ICAO. However it should be noted that the risk 
of non-compliance elsewhere in Europe is outside the direct control of NATS and represents a threat to both 
NATS and UK airlines. 


2.5 NATS does not consider that the Year 2000 problem represents a threat to the safety of the air traffic 
service. With loss of operational information, air traffic controllers would progressively impose traffic flow 
restrictions to ensure that safety margins were not eroded. The manufacturers of airborne systems and 
equipment, with the potential to be affected by the Year 2000 problem, have been required by SRG to provide 
assurance that there can be no condition that could result in a hazardous effect on aircraft. 


Effectiveness of action taken to avert problems 


2.6 The CAA and NATS are confident that action taken will be effective in understanding the risk and 
reducing it to a manageable level. Contingency plans will be developed later when there is more knowledge 
of residual risks. It is very clear now that action was justified and that efforts must be sustained to complete 
the remedial plan. Confidence that dependent organisations are adequately prepared can only be built by 
active co-operation, and this takes time to develop. We hope to encourage action by involvement in 
validation tests. 


Role of Government in raising awareness, seeking solutions, etc 


2.7 Government has been effective in raising awareness via the Taskforce 2000 effort. We are waiting to 
see how the Action 2000 initiative develops. We are also aware of material producted by CCTA, the DTI, 
and professional bodies such as Computer Software Services Association (CSSA) and the British Computer 
Society (BCS). The Government should continue to stress the importance of the issue, proving as much advice 
and encouragement as it can, but should make it clear that only organisations themselves can sort this 
problem. It is clear from diseussions with colleague organisations in Europe that the UK is better prepared 
than most countries for the Year 2000 problem. Some important strategic advantages may be derived from 


being well prepared at a national level, however there is also a risk to the UK’s interests of a knock-on impact 
of Year 2000 failure elsewhere in the world. 
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Extent to which new systems and software are “millennium compliant” 


2.8 There are still problems with purchasing new IT equipment. We have recently purchased a batch of 
PCs where some comply, and some do not. This highlights a configuration management problem within the 
industry. Due to the lengthy period taken to field new operational systems, problems can arise because orders 
were placed before Year 2000 became a “well known” issue. 


Development of contingency plans in the event of system failures 


2.9 The CAA and NATS do not believe it is possible to guarantee the elimination of all risks associated 
with the Year 2000 problem and intend to develop contingency plans, so that operations can continue in the 
event of an unusual pattern of system failures. This will be consistent with normal operational practice for 
NATS: specific measures can be prepared based on the knowledge gained from the validation tests to be 
carried out during late 1998. 


Legal implications of disputes over liability for compliance costs and system failures 


2.10 In the main, Year 2000 is about co-operative partnership between organisations to resolve issues 
before problems occur. However, in case of negligence, suppliers will be held responsible and legal 
proceedings may be taken. The CAA and NATS are seeking to indemnify themselves against Year 2000 risks 
by actively managing their insurance programme. 


3. ANSWERS TO THE QUESTIONS RAISED IN THE COMMITTEE CLERK’S LETTER OF 25 NOVEMBER 1997 


What estimation has CAA/NATS made to the seriousness of the “millennium bug” problem? 


3.1 NATS initially recognised the problem in early 1996 anda study, lasting from April to September 1996, 
was undertaken to assess the impact of the problem. A report was published which concluded that problems 
did exist and that they had to be addressed. A key recommendation was that an organisation-wide project 
should be established to manage the issue. As a result, NATS established a Year 2000 project to ensure that 
the company was fully prepared for Year 2000. 


3.2 A similar study, for assessing the implications for SRG’s computer based business systems, was begun 
in May 1997 and subsequently completed in July. Since that time activities have been set up in the other parts 
of the CAA to address Year 2000 and there is regular liaison between these project groups - in the form of a 
CAA Year 2000 Liaison Working Group — to share experience and to avoid overlaps and gaps in coverage. 
Meetings with the Federal Aviation Administration are also taking place to share experiences. As a result of 
the assessment the CAA has identified which changes to systems/equipment are required, and this work is 
now underway. The current estimate is that the project will cost CAA overall of the order £10 million, with 
NATS taking the majority share. 


What steps have been taken, and when, to avert problems in computer systems and software at the millennium? 


3.3 The Year 2000 project was set up in late 1996 to cover all NATS systems and is responsible for 
managing and monitoring overall Year 2000 readiness. The project has defined common processes and the 
reporting mechanisms to be used by business divisions within NATS. Each business division is accountable 
for its own readiness and is committed to the overall NAT-wide project framework. The project has defined 
the following phases for operational systems: 


(i) Inventory and assessment of operational systems was completed by July 1997. 
(ii) Fixing identified problems and re-test by July 1998. 

(iii) Multi-system Validation Tests from September to December 1998. 

(iv) All operational systems being fully prepared by end of December 1998. 


3.4 For non-operational systems, similar phases of activity are defined culminating in all systems with 
significant impact being ready by the end of December 1998. 


3.5 Each business division has appointed a Year 2000 local project manager who is responsible for 
planning and progressing all Year 2000 activity associated with that part of the organisation, and of 
coordinating with the NATS project team. The NATS project manager holds regular progress meetings with 
the key focal points and their staff. Each item of operational equipment in service has a nominated member 
of staff who is ‘responsible for ensuring maintainability. These nominated staff are required to identify all 
equipment, to assess the Year 2000 risk, to repair and validate these systems. This includes assessing and 
managing the risk associated with external suppliers (such as telecommunications service providers) and 
dependencies on external organisations (such as datalinks with other ATC authorities). 
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3.6 For new systems coming into service, the project managers are responsible for ensuring that 
requirements and acceptance testing cover Year 2000 compliance. NATS procedures ensure that new 
equipment will not be put into service without checking for Year 2000 compliance. NATS Contracts and 
Purchasing are applying Year 2000 compliance conditions to all purchases. 


How much work remains to be done to ensure a smooth transition from 1999 to 2000? 


3.7 For operational systems, the fixing of problems will be completed by the end of July 1998. We are 
working on the strategy for our validations tests, due to be carried out from September to December 1998. 
After this, we will prepare contingency plans. For non-operational systems, we still have some work to 
complete assessment, but the problems found to date are manageable. There are some system replacements 
planned which need to be dovetailed into the Year 2000 plan. The fixing and re-testing work needs to be done 
during 1998 so that systems with significant business impact are all ready by the end of 1998. 


How confident is CAA/NATS that it will encounter no problems at the millennium resulting from the inability 
of computer systems to handle the date change? 


3.8 The Year 2000 programme addresses two aspects. Firstly reducing risk in our own systems by 
assessment, validation testing and contingency plans and, secondly, by understanding how external 
dependencies can affect our operations. We are confident that the internal risks will be worked down to a 
manageable level such that they can be handled by our normal operating procedures (which include dealing 
with abnormalities) plus any additional Year 2000 contingency that is found to be necessary. Our declared 
goal is to be in a position to deliver services as on a usual day and we know of no reason, at this stage, why 
this should not be achievable. 


3.9 We are getting a mixed response from suppliers and other air traffic service providers. Most 
organisations respond positively and quickly but some do not. Telecom services, both UK and international, 
are a key dependency and we are liaising with their Year 2000 teams to build confidence. Provision of the 
ATC services goes beyond national boundaries. To build confidence that the system overall is ready for Year 
2000 requires that all air traffic service organisations world-wide are adequately prepared. Although NATS 
has no direct control of this, it is using its influence to raise awareness of the problem. In the Spring of 1997, 
NATS formally raised this issue with Eurocontrol and with ICAO. Eurocontrol is in the process of 
establishing the status of plans that exist within the European States. ICAO has distributed a letter to member 
States on the topic. NATS will continue to monitor the situation and feels that pressure from airlines, airline 
associations (and possibly inter-government) will help to prompt the necessary responses from these 
organisations. 


What, if any, are the major constraints on CAA/NATS which may hinder work on averting computer system and 
software failures at the millennium? 


3.10 Timescales are fixed and must be met. All areas of CAA/NATS are giving their Year 2000 efforts a 
high priority to achieve this. Allocation of effort and funds for this work is included in business plans. Most 
of the effort is in-house. The problems found to date are considered manageable within our available 
resources. As stated above, other ATC service providers are not under our control. 


Has CAA/NATS developed contingency plans should computer systems fail at the millennium? 


3.11 Despite having redundancy and fallback capability, computer systems occasionally fail during 
normal operation. Because of this, NATS has operating procedures to cope with equipment failure. No new 
equipment is introduced to service without a thorough examination of its failure modes. The main objective 
of the Year 2000 Validation Tests is to identify what type of risks remain once the identified fixes have been 
introduced. The results of these tests will be a primary input into any additional contingency plans to cover 
the high risk periods, such as the millennium roll-over and the leap year recognition. Such contingency plans 
will be developed early in 1999. 


What would be the consequences of such a computer failure for CAA/NATS? 


3.12 NATS operating procedures ensure that, when system problems occur, air traffic flow restrictions are 
progressively applied to match the condition, so that safety margins are not eroded. The impact on the service 
depends on which systems are affected; for example, a loss of flight data will cause a reversion to manual 
operation and procedural control with consequent reduction in traffic flows. 
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Whom would CAA/NATS hold to be responsible? 


3.13 NATS is responsible for the provision of air traffic services and the management of its own systems. 
NATS is taking action to gain assurance of preventive action being taken by suppliers and co-providers. In 
cases of negligence, suppliers would be held responsible for failure to deliver service and legal proceedings 
could be taken. CAA/NATS is seeking to indemnify the company against Year 2000 risks by actively 
managing its insurance program. 


What have CAA and NATS done to ensure that there will be no failures in safety critical systems within its 
control? How confident is CAA/NATS that there will be no such failures? To what extent have the Health and 
Safety Executive been involved in such preparations? 


3.14 NATS does not consider that Year 2000 represents a threat to the safety of the air traffic service. With 
consequential loss of operational information, air traffic controllers would progressively impose traffic flow 
restrictions to ensure that safety margins were not eroded. The manufacturers of airborne systems and 
equipment, with the potential to be affected by the Year 2000 problem, have been required by SRG to provide 
assurance that there can be no condition that could result in a hazardous effect on aircraft. There has been 
no specific involvement by the Health and Safety Executive in the work to date. 


4. CONCLUSION 


4.1 The CAA and NATS would be pleased to provide whatever further advice and information the 
Committee may require. 


7 January 1998 


APPENDIX 43 
Memorandum submitted by the Association of British Insurers 


1. INTRODUCTION 


1.1 The Committee have requested a memorandum to be submitted from the Association of British 
Insurers (ABI) on this topic. ABI represents over 440 insurance companies which, between them, account for 
over 95 per cent of United Kingdom insurance company business. 


1.2 The Committee is particularly interested in the ABI’s views on the extent to which insurers are likely 
to be able to provide cover against millennium related risks, both in computer systems and embedded chips 
in use either commercial or domestic environments. 


2. FEATURES OF THE MILLENNIUM FROM AN INSURANCE PERSPECTIVE 


2.1 The Year 2000 problem is currently a major issue for insurance companies in two respects. Firstly, 
insurance companies own IT systems are affected by the millennium bug. Secondly, insurers have to decide 
how they will deal with Y2K exposures in the policies they issue and specifically as to whether cover should 
be provided or not. This paper will concentrate on the latter point. 


2.2 The “millennium bug”, by its very nature, is a global problem and it will therefore impact on the global 
business and insurance communities. The problem also has several unique features which, when taken 
together, suggest that insurance cannot be viewed as the means for companies to protect themselves against 
the risks of not being millennium compliant. These can be summarised as follows: 


— The problem is very difficult to quantify, but under some scenarios the cost could be so vast it could 
threaten the capital base of the UK insurance industry if widespread cover was provided. It is likely 
to have various manifestations which could lead to property damage, legal liabilities, interruption 
of business and various other difficulties. The insurance industry is in the same position as everyone 
else in trying to assess the magnitude of the problem and in such a situation it is very difficult to 
provide cover without threatening the insurance industry’s solvency. 


— Insurers have no experience in dealing with this risk. Insurance products usually develop slowly in 
response to normal market forces, allowing insurers to adapt their pricing as understanding of the 
risk increases. But here we are dealing with a “one-off” situation which will result in insurance claims 
manifesting themselves over a short period of time. If insurers miscalculate the risk, they would find 
it difficult to recover any losses from future underwriting as the millennium risks occur by definition 
infrequently. 

— Insurance is designed to protect against consequences of unpredictable and unforeseen events. The 
Year 2000 is predictable and foreseeable and has been since the present calendar came into effect. 
It is also predicatable and foreseeable in that many computer systems in the corporate sector will 
need modification if they are to cope with the millennium. 
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2.3 Prudent companies are aiming to do the necessary work well before December 1999. Such 
“preventative” work will not be covered under any insurance. Rather, this should be seen as necessary risk 
management by industry. 


3. INSURANCE INDUSTRY ACTION ON YEAR 2000 


3.1 To date, insurance industry action has fallen into three categories: 
— evaluating exposures; 
— educating policyholders; and 
— deciding what policy should be adopted for dealing with exposures. 


Evaluating Exposures 


3.2 In common with other business sectors, insurers only recently became aware of the nature of the Year 
2000 problem and the potential exposures which may arise under existing policy wordings. With this in mind 
ABI commissioned a legal report in the first quarter of 1997 from the legal firm Cameron McKenna on the 
subject. The report: 


— defined the millennium problem; 
— considered its potential ramifications; 


— reviewed the primary areas on which the potential ramifications may impact with reference to 
insurance clauses found in several classes of insurance; and 


— _ considered various avenues open to insurers to protect themselves against the risk. 


3.3 The report concluded that, as insurers had not contemplated this problem when drafting policy 
wordings, insurers could have potential exposures under a variety of different types of commercial policies 
including: 


— material damage (to property) and business interruption; 
— public and products liability; 

— professional indemnity; 

— machinery loss of profits; and 

— directors’ and officers’ liability. 


3.4 Whilst many existing clauses in these commercial insurances, such as those excluding the consequences 
of latent defects in the insured property, may remove or limit cover, the potential ramifications of the 
millennium problem were considered to be so many and unpredictable that the effectiveness of standard 
exclusion clauses was uncertain. 


3.5 The report advised insurers to consider new business and the renewal of existing business with this in 
mind: if insurers chose to incorporate specific exclusion clauses to exclude millennium problems, these should 
be expressed in clear and unambiguous terms. 


3.6 On receiving the report, ABI members requested that, in the interest of economies of scale and 
consistency, ABI should produce model exclusion clauses in those classes of commercial business identified. 
ABI did not issue any recommendation to members about how to deal with Y2K exposures because it was 
viewed as entirely a matter for individual insurers as to whether they used the exclusion clauses or not, or 
produce their own versions of the clauses. 


3.7 In due course ABI circulated the model clauses to members advising that it was up to each individual 
member whether or not they applied the exclusions. 


’ 


3.8 These wordings were largely aimed at commercial insurances, but could of course be applied to 
“personal lines” insurances like household, travel, motor etc if insurers felt they were exposed in these areas. 


Educating policyholders 


3.9 Through issuing this report, ABI raised awareness amongst its members of the Year 2000 problem. 
ABI has also produced an information leaflet aimed at Small and Medium sized Enterprises to raise 
awareness of the problem and advising them to discuss the issue with their insurance broker or company. ABI 
members have purchased 709,000 copies of the information sheet for distribution to SMEs (copy attached). 
Individual insurers are also producing leaflets and raising awareness amongst “personal lines” customers. 


3.10 ABI is of the view that its membership is now relatively well informed about the issue, and through 
the information leaflet and contacts with other organisations, has helped to raise awareness generally. 
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Deciding what policy should be adopted for dealing with exposures 


3.11 ABI has recently issued a questionnaire to its members to obtain clarity as to how they intend to treat 
millennium exposures. From responses received so far it would seem that most commercial insurances will 
exclude Y2K exposures. In particular, legal liabilities arising from the millennium bug are likely to be 
excluded wherever possible. 


3.12 However, with regard to commercial property insurances, some insurers appear willing to offer an 
element of cover in respect of property damage caused by certain defined perils, even if the original cause of 
an incident was a Y2K failure. Such defined perils include Fire, Explosion, Aircraft, Escape of Water and 
Impact. To what extent such cover is available will only become clear as insurers evaluate their exposures 
under these policies. 


3.13 It is not yet clear what the response of the personal lines insurers, ie household insurers and motor 
insurers, will be. This will depend on their perception of the risk. 


3.14 ABI is aware that international insurance markets are considering the issue with some urgency and 
it is understood that several insurers in the US have signalled their intention to exclude Y2K losses from 
commercial insurances. 


3.15 ABI will be happy to submit a summary of responses to its questionnaire on insurers’ intentions on 
Y2K to the Committee as soon as they have been received from all major insurers. 


16 January 1998 


APPENDIX 44 


Memorandum submitted by the British Chambers of Commerce 


In accordance with your request dated 4 December, I am pleased to provide comments on the issues raised. 


The British Chambers of Commerce is the largest business network in the United Kingdom, with 62 
Approved Chambers throughout the country, representing over 110,000 business members. 


The issue upon which you are seeking comments will no doubt have an impact, to a greater or lesser extent, 
right across the business community. However, small firms are often more vulnerable than larger firms due 
to a lack of resources. This can result in a low level of awareness, an inclination to defer problems or not 
having the required in-house expertise to resolve technical challenges. From the Government’s perspective 
there is the difficulty in targeting initiatives to small firms. 


ASSESSMENT OF THE SCALE OF THE PROBLEM FOR SME’S 


The Year 2000 issue is likely to be a major problem for many businesses. However, it is not possible to 
judge the scale of the problem for SME’s at the moment as many of them have not started to address the issue. 
A particular difficulty is getting firms to recognise that the Year 2000 issue is well beyond computers. 


The costs of updating equipment could be significant and may lead to more SMEs needing to borrow. 
Whilst borrowing itself should not cause business failure, the failure to address the problems could. 


The Association of British Insurers has warned that it “cannot and will not meet the consequences of 
businesses failing to modify their systems in time for the millennium date change.” 


A factor which could work to the advantage of some SMEs is that many smaller firms buy “off the shelf” 
software. This, in comparison to bespoke packages, may well mean SMEs are less exposed to the problems 
that are associated with millennium compliance. 


The impression is that many small businesses owners still do not yet realise the extent of the problem. 


Tue LEVEL OF ACTIVITY IN PREPARING SYSTEMS FOR THE YEAR 2000 AMONG SMEs 


The NatWest-sponsored publication “The Year 2000 Computer Problem” provides a clear illustration of 
the process of becoming millennium compliant. The steps suggested are as follows: 
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1 Awareness 





2 Inventory 
3 Assessment 

4 Planning 
5 Changing 

6 Testing 


Source; The Year 2000 Computer Problem - NatWest - Jonathan Whelan 


There appears to be little consistent action from business owners, with those that have awareness often 
hugely underestimating the cost, effort and time of compliance. 


The initial work of preparing inventories and assessing the problem has been slow to gain widespread 
momentum although among larger SMEs it has started to increase over the last six months. Some firms still 
consider the Year 2000 to be too far away—the reality is, it is not. 


In general terms, there appears to be a low level of response to Chamber awareness activity, which include 
mailshots, editorial articles and seminars. However, Chamber-organised seminars are seeing ever increasing 
attendance levels although there is a reluctance among firms to spend money on this issue. 


THE LEVEL OF TECHNICAL ASSISTANCE 


A significant problem is in a skills shortage to reconfigure many older systems which are still in use, with 
there being a lack of programmers with knowledge of old computer languages to meet the demand. This is 
creating difficulties for SMEs which have modified old systems rather than replaced them. SMEs tend to have 
a longer timescale for depreciating capital equipment which makes them vulnerable to problems such as these. 


As businesses defer sorting out the problem there will be an increasing shortage of qualified consultants to 
employ, which is likely to affect SMEs more than large firms as in many cases larger businesses have dedicated 
IT managers and can afford to buy-in consultancy. As highlighted in the BCC small firms survey on training 
there is a need for improvement among employees and management in computer and IT skills. 


Consideration must also be given to non computer equipment such as lifts, photocopiers, air conditioning 
and manufacturing equipment; it is probable that people with these skills will not be among existing 
employees. 


THE ROLE OF GOVERNMENT 


The Government has a very important role to play in communicating the correct message to business. At 
present the message has not hit home to the SME sector. The communication of the potential problem needs 
to be accompanied by information on what SMEs need to do next. 


The respective roles of Taskforce 2000 and Action 2000 are not familiar to all businesses and the objectives 
of these need to be clearly communicated and understood. Whilst the Government may have done enough 
to influence larger businesses there is the need for more communications to reach to all sizes of businesses to 
raise the importance of this issue. 


BCC Support 


In 1998, BCC will be undertaking a major piece of work in the field of information technology. We will 


also be conducting a small firms survey on IT, which will include an assessment on how the Year 2000 problem 
is being addressed by the SME sector. 


21 January 1998 
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APPENDIX 45 
Memorandum submitted by the Advertising Standards Authority 


INTRODUCTION 


1. Established in 1962, the Advertising Standards Authority promotes and enforces the highest standards 
in all non-broadcast advertisements by supervising the advertising industry’s system of self-regulation. The 
ASA ensures that everyone who commissions, prepares and publishes advertisements in the non-broadcast 
media within the UK observes the British Codes of Advertising and Sales Promotion. 


1.1 The Codes require advertisements to be “legal, decent, honest and truthful”, socially responsible and 
prepared in line with the principles of fair competition. They reverse the burden of proof applied in law, so 
it is up to advertisers to prove any claims they make, not for the ASA to disprove them. If they cannot do so 
the advertisement must be withdrawn. This common sense approach takes into account the nature of the 
product being advertised, the media used, and the audience being targeted. 


SUMMARY 


2. According to the Authority’s most recent research, advertising standards within the non-broadcast 
media in the UK are extremely high. To date the ASA has seen no evidence that computer advertisers are 
misleading consumers about the compliance of their products with the Year 2000. Last year the Authority 
investigated just three complaints relating to the Millennium problem generally, and the relevant 
adjudications appear in the appendix to this paper. As for those advertisers who do mislead or offend, the 
ASA has a range of effective sanctions at its disposal. 


WHAT IS THE AUTHORITY DOING TO ENSURE THAT THE ADVERTISEMENTS STATING THAT PRODUCTS ARE YEAR 
2000 COMPLIANT ARE ACCURATE? 


3. Advertising self-regulation features a number of proactive and preventative functions, such as offering 
pre-publication guidance to advertisers, agencies and the media or monitoring problematical advertising 
sectors. It does not, however, pre-vet all non-broadcast advertisements as this would be logistically 
impossible; an estimated 30 million advertisements (and three billion items of direct mail) are published in 
the UK each year. 


3.1 Code compliance levels are nevertheless extremely high. The Authority’s most recent research 
indicated that 98 per cent of poster advertisements, 96 per cent of press advertisements and 85 per cent of 
direct marketing advertisements comply with the Codes. We believe this is down to the work of the ASA and 
its industry wing, the Committee of Advertising Practice. High advertising standards also make sound 
commercial sense; they generate consumer trust which, in turn, results in more effective advertising. In 1997, 
8,291 advertisements attracted a total of 10,678 complaints and were subject to ASA scrutiny. Following 
investigation, just 512 advertisements were found to break the Codes rules. 


3.2 It is the responsibility of individual media owners to check the acceptability of advertisements against 
the Codes before publishing them. However, while publishers may be able to spot prima facie breaches of the 
rules, they could not be expected to test the veracity of claims that a product was Year 2000 compliant. 
Moreover we have no reason, given the above, the believing that such misleading claims are being made. 


4. WHAT STEPS CAN THE AUTHORITY TAKE AGAINST THOSE FALSELY ADVERTISING PRODUCTS AS YEAR 2000 
COMPLIANT? HAS ANY SUCH ACTION BEEN TAKEN TO DATE? 


4.1 An effective range of sanctions underpins the success of the ASA in maintaining high standards. If an 
advertisement breaks the rules, the Authority asks the advertiser to amend or withdraw it. In the 
overwhelming majority of cases advertisers comply immediately with such a request. If they do not, media 
owners will invoke their standard terms and conditions of business and refuse further advertising space. 
Although the ASA supervises a self-regulatory system, advertisers can not opt out. Both they and their 
agencies may also jeopardise their membership of trade organisations, as well as the incentives attached, if 
they persistently break the Codes’ rules. The Authority’s adjudications are published in the ASA Monthly 
Report which is circulated widely to the media. It generates a high volume of negative publicity for advertisers 
who mislead or offend and, in doing so, also encourages high compliance rates with the Codes. 


4.2 A legal backstop exists to deal with the rare occasions when the ASA is unable to prevent a misleading 
advertisements from appearing. We can refer the case to the Office of Fair Trading (OFT) which can seek an 
injuction, under the Control of Misleading Advertisements Regulations 1988, to prevent misleading claims 
from being repeated. 


4.3 Last year the ASA investigated three public complaints about advertisements relating to Millennium 
computer problem. Full details of the Authority’s adjudications appear in the appendix. 
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5. Do you FEEL THAT THE PUBLIC Is ADEQUATELY PROTECTED AT PRESENT FROM FALSE ADVERTISEMENTS IN 
RELATION TO MILLENNIUM COMPLIANCE? IF NOT, WHAT GREATER PROTECTIONS DO YOU ADVOCATE? 


5.1 To date we have seen no evidence to suggest that any significant problems exist with misleading 
advertising relating to millennium compliance. We are aware that the Millennium computer problem has 
already received widespread publicity in the media but would nevertheless encourage any further initiative 
to raise awareness of the issue among consumers. 


12 February 1998 


APPENDIX 46 
Supplementary Memorandum submitted by the Chancellor of the Duchy of Lancaster 


SUMMARY OF DEPARTMENTAL AND AGENCY PLANS 





Estimated _ Existing 
Department/Agency Target Cost PES? Progress Document Type 
Cabinet Office ince OPS 
Centre December 1998 £27,600 Yes — Remedial action underway _ Full plans 
Buying Agency September 1998 £10,000 Yes Assessment underway Summary 
Central Computer & End of 1998 £47,000 Yes Audit underway PID—includes 
Telecommunications Agency plans 
Central Office of Yes __ Virtually no impact Status report 
Information 
Civil Service College December 1997 £0 Yes Currently upgrading Summary action 
systems as part of IT plan 
strategy 
Government Car and April 1998 £23,000 Yes — Testing for compliance Outline plan 
Despatch Agency 
Property Advisers to the £15,000 Yes Audit Summary plan 
Civil Estate 
Security Facilities Executive Audit complete Letter 
Department for Culture, Media and Sport 
Centre September 1998 £65,000 Yes Remedial action underway Comprises 
GANTT chart 
Historic Royal Palaces Late 1999 £100,000 Yes Part of Dept Plan 
Royal Parks April 1999 £100,000 Yes Part of Dept Plan 
Department for Education and Employment 
Centre December 1998 £4,800,000 Yes Auditscomplete, about to —_— Impact analysis 
start development 
Employment Service March 1999 £23,150,000 | Yes —_ Determination of action Summary plan, 
plan includes GANTT 
chart 
Department for International Development 
Centre End of 1998 £200,000 Yes Scoping study complete Summary plan 
Department of Environment, Transport and Regions 
Centre December 1998 £2,200,000 Yes Assessment done, remedial Impact analysis 
work started and GANTT 
charts 
Coastguard Agency Mid 1999 £100,000 Assessment complete, Situation report 
options being considered 
Driver and Vehicle December 1998 £300,000 Systems assessmentialmost Submission to 
Licensing Agency finished. NAO, extensive 
supporting 
documents 
Driving Standards Agency December 1998 £48,000 Yes Collecting data Progress report 
Highways Agency December 1998 £4,300,000 Preparing PID Progress report 
Marine Safety Agency December 1998 £38,305 Main systems being Activity charts 
amended and tested with progress, 
costs and 
resources 
Planning Inspectorate March 1999 £197,500 Yes Inventory complete, new Summary plan 
y, systems being installed including 
timetable and 
cost estimate 
QEII Conference Centre April 1998 £0 Compliant except security —_ Letter 


system 
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(Forest Enterprise, Forestry 


Commission Research 
Agency) 


Government Offices for the Regions 


(Reports to DTI, DfEE, 


DETR) 


Estimated 
Department/Agency Target Cost 
Vehicle Certification December 1998 £0 
Agency 
Vehicle Inspectorate March 1999 £0 
Agency 
Department of Health 
Centre and all agencies End February £6,100,000 
(Medical Devices Agency, 1999 
Medicines Control Agency, 
NHS Estates, NHS Pensions 
Agency) 
Department of Social Security 
Centre and all Agencies Major systems £45,692,000 
(Benefits Agency, Child 31/8/98, others 
Support Agency, by 31/8/99 
Contributions Agency, IT 
‘Services Agency, War 
Pensions Agency) 
Department of Trade and Industry 
Centre March 1999 £2,700,000 
Companies House Easter 1999 £317,000 
Employment Tribunals End of 1998 £40,000 
Service 
Insolvency Service End of 1998 £7,200 
National Weights and £61,000 
Measures Laboratory 
Patent Office March 1999 £850,000 
Radiocommunications December 1998 £1,000,000 
Agency 
Export Credits Guarantee Department 
(Reports to Pres. of Board End of £184,187 
of Trade) March 1998 
Foreign and Commonwealth Office 
Centre End of £1,857,000 
September 1999 
Wilton Park 
Forestry Commission 
Centre and all agencies March 1999 £650,000 


Existing 
PES? 


Progress 
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Document Type 





Yes 


Yes 


Yes 


ies 


Yes 


Yes 


Systems assessed, 
replacement part of IT 
strategy 

System replacement in 
progress 


Remedial action underway 


Remedial action underway 


Assessing main systems 


Inventory and audit 


complete, conversion started 


Auditing Systems 
Testing existing systems 
Inventory and compliance 


assessment complete 


Auditing systems and 
contacting suppliers 


Inventory complete, some 
code checking under way 


Inventory and Audit 
complete 


Some corrective work 
underway 


No Action Required 


Starting a pilot study 


Survey stage 


Position 
statement 


Situation report 
of IS strategy 
plan 


Extensive 
supporting 
documents (cost 
supplied sep; excl 
embedded 
systems) 


Extensive support 
documentation 
compiled by 
ITSA 


Summary plan 
and activity chart 
High level plan 


Summary 
Plan/Situation 
Report 

Report on 
progress and 
plans 

Situation report 
and outline 
action plan 
Activity chart 
and covering 
letter 

Progress report 
and Gantt chart 


Assessment and 
programme 
reports 


Project 
description, risk 
management 
proposal 

Phone call with 
F&CO 


Summary plan 


Project 
description & 
status report 
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Estimated Existing 
Department/Agency Target Cost PES? Progress Document Type 
HM Customs and Excise 
(Report to Chancellor of December 1998 £5,500,000 Yes Converting systems, broadly Detailed Gantt 
Exchequer) on target charts 
HM Land Registry 
(Reports to Lord April 1998 £1,500,000 Yes Remedial action underway _ PID, activity 
Chancellor) charts and 
progress report 
HM Treasury 
Centre End of £114,000 Yes Audit of central systems Statement of 
March 1999 complete intent + costs 
Home Office 
Centre and all agencies February 1999 £17,500,000 ics Audit completed PID and 
(Fire Service College, background 
Forensic Science Service, UK material 
Passport Agency, HM Prison 
Service) 
Inland Revenue 
(Reports to Chancellor of | December 1998 £26,000,000 Yes Remedial work underway, — Costs, milestones, 
Exchequer) broadly on target Gantt 
Valuation Office End of 1999 £569,700 Replacement of main Costs, progress 
systems well advanced report and Gantt 
chart 
Intervention Board for Agricultural Produce | 
(Reports to MAFF, SO, August 1998 £724,000 Yes Assessment complete, Systems | 
WO, NIO) replacements underway overview, 
summary plans 
Law Officers’ Departments/Attorney General 
Government Property December 1998 £50,000 Position paper 
Lawyers 
Treasury Solicitor’s March 1998 £115,000 Inventory completed Outline plans 
Department 
Lord Advocate’s Department 
Centre Autumn 1998 Testing about to start TOR and 
Objectives 
Crown Office for Scotland Autumn 1998 Testing about to start TOR and 
Objectives 
Lord Chancellor’s Department 
Centre and all agencies April 1999 £4,927,750 Yes Remedial action underway Full plans 
(Court Service, Public Trust 
Office) 
Ministry of Agriculture, Fisheries and Food 
Centre and all agencies April 1999 £11,100,000 Yes Most audits complete, Top level » 
; : 
(CEFAS, Central Science coversion started programme 
Lab Babee & Rural plans, project and 
aboratory, Farming ura | cont.curinaien 
Conservation Agency, Meat 
Hygiene Service, Pesticides | 
Safety Directorate, Veterinary 
Laboratories Agency, | 
Veterinary Medicines 
Directorate) 
q 
Ministry of Defence 
Centre and all agencies January 1999 £200,000,000 Yes Remedial action underway Progress 


(Armed Forces 
Personnel j 
Administration 
Agency, 
Army Base Repair 
Organisation, 


summary report 
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Estimated Existing 
Department/Agency Target Cost PES? Progress Document Type 








Army Base Storage & 
Distribution 
Agency, 

Army Training & 
Recruitment 
Agency, 

Army Personnel 
Centre, 

Army Technical 
Support Agency, 

Defence Analytical 
Services Agency, 

Defence Animal 
Centre, 

Defence Bills Agency, 

Defence Clothing & 
Textiles Agency, 

Defence Codification 
Agency, 

Defence Dental 
Agency, 

Defence Estate 
Organisation, 

Defence Evaluation & 
Research Agency, 

Defence Intelligence & 
Security Centre, 

Defence Medical 
Training 
Organisation, 

Defence Postal & 
Courier Services 
Agency, 

Defence Secondary 
Care Agency, 

Defence Transport & 
Movements 
Executive, 

Defence Vetting 
Agency, 

Disposal Sales Agency, 
Duke of York’s Royal 
Military School, 

Joint Air 
Reconnaissance 
Intelligence Centre, 

Logistic Information 
Systems Agency, 

Medical Supplies 
Agency, 

Meteorological Office, 

Military Survey, 

Ministry of Defence 
Police, 

Naval Aircraft Repair 
Organisation, 

Naval Bases & Supply 
Organisation, 

Naval Manning 
Agency, 

Naval Recruiting & 
Training Agency, 

Pay & Personnel 
Agency, 

Queen Victoria School, 

RAF Logistics 
Support Services, 

RAF Maintenance 
Group Defence 
Agency, 
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Department/Agency Target 


Estimated Existing 


Cost PES? Progress 





RAF Personnel 
Management 
Agency, 

RAF Signals 
Engineering 
Establishment, 

RAF Training Group 
Defence Agency, 

Service Children’s 
Education, 

Ships’ Support 
Agency, 

Specialist Procurement 
Services, 

UK Hydrographical 
Office) 


National Savings 


(Reports to Chancellor of | December 1998 


the Exchequer) 


Office for National Statistics 


(Reports to Chancellor of 
the Exchequer) 


June 1999 


Ordnance Survey 


(Reports to Secretary of 31 March 1998 


State ETR) 


Public Record Office 


(Reports to Lord 
Chancellor) 


December 1998 


Royal Mint 


(Reports to Chancellor of 
the Exchequer) 


End of 1999 


Scottish Office 


Centre and all agencies December 1998 


(Fisheries Research 
Service, 
Historic Scotland, 
Registers of Scotland, 
Scottish Agricultural 
Science Agency, 
Scottish Court Service, 
Scottish Fisheries 
Protection Agency, 
Scottish Office 
Pensions Agency, 
Scottish Prison 
Service, 
Scottish Record Office, 
Student Awards 
Agency for 
Scotland) 


Welsh Office 


Centre and agency (Cadw: De&mber 1998 
Welsh Historic Monuments) 


November 1997 


ee 


£3,583,754 Starting conversion work. 


£2,470,543 Initiation complete. 


Inventory started 


£800,000 Yes Audit completed, test 


planning underway 


£906,541 Yes Inventory and System 
assessment 


complete 


£12,000 Yes — Fully compliant 


£2,000,000 Yes Inventory complete, pilot 


started 


Yes Audit complete, checking 
systems 


Document Type 


High level 
activity chart 
with costings 


Initiation 
document and 
plans 


Covering Letter 
and detailed 
Gantt 


Full plan 


Letter only 


Assessment 
report + activity 
plans 


Progress report 
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APPENDIX 47 
Memorandum submitted by the Institute of Chartered Accountants in England and Wales 


INTRODUCTION 


1. The Institute of Chartered Accountants in England and Wales (ICAEW) has a membership of over 
110,000 members. Approximately half the membership works in practice and the other half works in finance, 
commerce and industry. The Institute has a wide-ranging knowledge and experience over the whole of the 
business arena and amongst its members’ specialisations is information systems. 


SUMMARY 


2. The ICAEW has through its Audit Faculty issued guidance to help its members consider the audit 
applications for the Year 2000 date change. 


In addition through the ICAEW Information Technology Faculty there has been a steady stream of advice 
and technical support to assist both members of the Faculty and other members in the ICAEW. 


For the reserved areas of Audit and Investment business inspection by the Joint Monitoring Unit seeks to 
ensure that auditors are addressing appropriate questions to their clients and that for Investment Business 
purposes, when relevant, appropriate procedures are in place. 


The ICAEW thinks that the Millennium problem is understood generally but has some concern that 
unscrupulous persons might prey on people’s fears about the problem and that the Government might 
actively consider this problem. 


SUBMISSION 


3. The Institute’s members do not face any specific problems in connection with the Year 2000 problem 
not encountered by others. Our members who act as auditors face a problem because of unrealistic 
expectations about what their responsibilities and role is. There might be companies who fail because of third 
party problems, embedded chips, etc which the auditor is unlikely to know anything about. The auditor’s role 
is to give an opinion on historic figures and consider going concern problems ie the company becoming 
insolvent. In relation to this particular problem the Institute’s Audit Faculty has issued a technical release 
which fully covers the responsibilities of directors and which is attached to this memorandum as Appendix 1. 


4. In order to ensure its members become millennium complaint, apart from the guidance offered in the 
audit technical release referred to above, the Institute through its Information Technology Faculty has 
distributed a briefing booklet in January 1997. The Information Technology Faculty’s monthly newsletter 
throughout 1996 and 1997 has been carrying articles on the subject to assist members and continues with that 
in 1998. The Faculty is shortly to distribute to its members a further publication on the subject. All these 
publications were, and will be available to other members of the Institute on request. In addition, since 1996 
the Faculty has held a number of seminars on this subject and promoted a conference. This programme of 
education will continue throughout 1998. 


5. The Institute seeks to regulate the professional standards of its members. The Institute seeks to provide 
and promote services which will help its members to adopt good business practice in relation to their business 
systems but it does not have powers to compel them to do so. However, if a member ceases to be able to 
operate his/her business coherently (eg because of deficiencies in its systems), this could, under certain 
circumstances, lead indirectly to disciplinary action by the Institute. Ifa member goes bankrupt, for the same 
reason, that member would of course be excluded from membership. 


The term “Year 2000 complaint” is formally defined by the British Standards Institute, but this formal 
definition, from a practical point of view, need not be achieved by all businesses. For practical purposes 
compliance for a particular organisation is relative, not absolute. It depends upon the specific circumstances 
of the organisation including: 

— Its degree of reliance upon computer systems. 

— The nature of that reliance. 

— The degree to which any particular date-related function within the computer programme is 
deficient. 

— The degree to which such deficiency is crucial to the organisation. 

— The degree of inter-action of the organisation’s systems with those of other organisations which 
themselves may be deficient. 

It would therefore be almost impossible to define a regulation for “forcing” compliance which would be 
sufficiently explicit without being extremely prescriptive or unnecessarily rigorous. 


In terms of our members in practice, the Joint Monitoring Unit on its visits will question firms. In the case 
of an audit visit a general question will be asked to discover what are the firm’s procedures for doing what is 
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recommended in the Audit Technical Release attached to this memorandum at Appendix 1*. Provided the 
audit firm has procedures in place to appropriately question its clients then no further action will be taken. 
If it does not have procedures it will be pointed towards the guidance issued. 


In the case of investment business our only concern is that the firm’s own systems are integral to, and 
dependant on, its management and giving of investment advice. If it is, we will require the firm to confirm 
that it is or has or is making them 2000 compliant. If this confirmation is not forthcoming, the Authorisation 
Committee may restrict the firm’s activities to avoid risk to investors until the firm solves its problems. 


6. The terms under which the Institute recommends whether its members qualify the accounts of 
companies not making sufficient progress towards compliance is set out in the Audit Technical Release at 
Appendix 1*. The Technical Release suggests that auditors consider qualifying the accounts of companies if: 


— The auditors consider they have not received sufficient information from management to accept 
management’s assertion that there is no significant impact on the business and, from their 
knowledge of the business they believe that there could be a material impact. 


— Itappears the company would suffer a going concern problem because of lack of progress to making 
the company complaint and lack of viable alternative plans and the company had not made this 
sufficiently clear in its accounts. 


7. In terms of litigious shareholders again our Audit Technical Release at Appendix 1* addresses that 
problem. There seems little our members could do to protect themselves from bankrupt suppliers over and 
above normal prudence considerations when dealing with a supplier. The responsibility for making a 
company Year 2000 complaint is that of the directors who have an important role to play here. Directors will 
need to be able to demonstrate that they have exercised due diligence in fulfilling their duties. 


8. As to whether the general public is sufficiently aware of the problem, it is our view that in general people 
do seem to be aware. This does not always lead to action. In many cases, particularly in very small businesses, 
this is because the problem is assessed, quite realistically, as likely to be minor. In other cases, businesses 
perceive a risk analysis as being relatively pointless because they perceive themselves as being more or less 
wholly reliant on their hardware and software suppliers to ensure the technical functioning of their systems. 
On the whole it seems likely that the general public is aware of the problem. The “Millennium Bug Campaign” 
of the group “Action 2000” and press comments have extensively drawn attention to the matter. We 
understand there is also a private members bill about Millennium Compliance by companies which, although 
it is unlikely to make progress, has also drawn attention to the matter. 


9. As to the issue of public ignorance being exploited, we have no hard information on which to make a 
judgement. Fears might be exploited by unscrupulous consultants and other suppliers, offering cut price, 
simplistic and possibly highly dubious advice or products, sometimes on the basis of cold calling. Confidence 
tricksters might persuade individuals to admit them to homes and possibly business premises by posing as 
engineers calling to test electrical devices, lifts, cookers, video players etc for Year 2000 compliance. Existing 
laws seem to cover such matters. There might be a role for advice from the Government and the regulated 
utilities, particularly in relation to domestic dangers. Perhaps the Government could introduce an approval 
system, such as was done with telecommunications equipment, to denote Year 2000 compliant goods. 


16 February 1998 


APPENDIX 48 
Memorandum submitted by Allen & Overy, Solicitors 


INTRODUCTION 


Allen & Overy is one of the UK’s leading international law firms. It has 177 partners and some 2,000 staff 
working in 19 major centres on three continents. Allen & Overy has just been awarded the prestigious Legal 
Business “Law Firm of the Year Award”. Our Information Technology Group, based in London, straddles 
the Litigation and Corporate Departments. This Group comprises 23 solicitors and 6 partners and has 
extensive experience of advising on millennium issues is corporate transactions as well as electronic commerce 
and banking. 


It is with this experience that we feel qualified to assist the Committee with its inquiry. We will concentrate 
on the legal aspects of this inquiry. 


SUMMARY 


a The problems surrounding the millennium compliance issue will have a significant impact on major 
industry sectors including finance and health; 


— The UK will be affected in the same way as other Western countries which are dependent upon an 
advanced computer infrastructure; 
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— Millennium compliance is a particular problem in relation to embedded software where the problem 
is difficult to detect and remedy before the year 2000; 


— Our view is that existing UK contract law and consumer protection legislation, together with 
remedies under the tort of negligence, offer adequate legal protection to UK consumers in 
connection with Year 2000 problems, bearing in mind this must be balanced against the interests 
of commerce; 


— Our experience indicates that many large businesses expect that their systems will be millennium 
compliant by the year 2000 but many smaller companies do not have the necessary resources to 
ensure millennium compliance which could have a significant impact on the economy as a whole. 


OPINION 
By way of assistance of the Committee we set out, prior to answering its questions, a brief statement as to 
the exact nature of the millennium problem. 


Most computer systems are date-critical using two-digit data fields. It is the inability of computer software 
and systems to recognise “00” that is causing the so-called “millennium”, “Year 2000” or “Y2K” problem. 
In the year 2000, it is thought that some software will read the year “00” as “1900” with the effect that wrong 
data will be stored, manipulated, or wrongly calculated, In the worst case, this may cause the computer system 
to crash. 


1. What type of legal action do you think will result from equipment failures at the millennium? Is the picture 
in the UK likely to be significantly different from other countries, and, if so, why? 


As computer chips can be found in so many everyday items from household goods to the most complex 
computer software in our leading financial institutions, the potential effect of the millennium problem is 
unprecedented in its scope. 


Examples of the type of legal action which may be brought are as follows: 


Computer Software/Systems Supply 


— actions for loss to library and database management systems; 


— actions by users of mainframe or PC systems which predate the recognition of the millennium 
problem. Even if applications used are able to cope with the problem this will be of no value if the 
mainframe cannot; 


— actions by purchasers of computer software against the supplier/manufacturer for losses suffered 
by the business; 


— actions by users against those who recommended the system or software; 

— actions by the business for liability to third parties as a result of the failure to remedy the software 
in time; and 

— actions by businesses for their management time and the loss to the business as a result of diverting 
IT resources from other projects*. 


Finance and Commerce 
— _ actions by the shopkeeper who loses business as a result of the rejection of credit cards whose expiry 
date is beyond the year “00”; 


— actions against investment banks, accountants, solicitors and other professionals who have given 
incomplete due diligence advice on the purchase of, or investment into, companies which have or 
may be affected by serious millennium problems; 


— _ actions by individuals whose personal pensions have been wrongly calculated; 
— actions against the Inland Revenue for its failure accurately to calculate income tax; 


— actions by the company whose payment tracking system has failed leaving it with a liability to 
Customs and Excise for VAT; 


— actions by small, medium or large businesses whose payment and receipt software miscalculates 
sums due and consequentially interest due; 


— actions by the financial sector for the failure of its forecasting software; and 
— actions by traders in the Stock Exchange who suffer loss as a result of a computer crash on that date. 





4 Claims for management time in the UK have been unsuccessful in the past. Claims under this head of damages in connection with 
losses for computer non-compliance have been brought for the first time and are currently following due process in US Courts. 
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Health & Product Safety 


— actions by the estate of the person who died, or a person who is seriously injured, as a result of 
hospital equipment failure on 01/01/00; 


— action by producers of food whose sell-by labelling software fails; 
— _ actions by individuals who are harmed by lift failure on that date; and 


— actions by residents in the neighbourhood of a chemical production plant whose equipment fails 
allowing noxious gas to escape. 


Consumer 


— _ action by the individual whose microwave oven, and other appliances with embedded chips, ceased 
to work on that date; 


— actions by individuals who are unable to travel as a result of the failure of aircraft or air traffic 
control systems on that date; and 


— _ actions by individuals whose utilities on telephone systems fail to operate on or after that date. 


These are 20 random examples of the type of claim which may be brought from the petty to the financially 
significant crash on the Stock Market. These examples indicate that a number of actions will be in the nature 
of “Group Actions”, which, by definition involve greater numbers of parties with attendant complications 
and escalation of costs. 


The millennium problem is a global one. There is no reason to believe that the problem will be significantly 
different in the UK from other countries. This problem will affect Western, developed countries where the 
use and incidence of computer chips and software is higher rather than countries where there is less computer 
infrastructure. 


Particular industry sectors are easy to identify as being the worst affected because of their reliance on 
software. They include the financial services sector; health and safety sector and mission-critical sectors such 
as transport and utilities (eg aviation, rail, shipping and gas, electricity and telecoms). Our experience with 
clients indicates that particular industry sectors were early to recognise the nature of the problem and are now 
in an advanced state of compliance. The Financial Services sector is a good example followed by other major 
corporates. Our experience is that the Public Sector is trailing behind. 


One point worth making is that, no matter how advanced compliance is in the UK at the millennium, the 
financial and commercial sectors in the UK are so dependent upon businesses and the public sector in other 
countries with whom we trade that the picture in the UK will be coloured by the compliance steps of our 
trading partners. 


2. Do you think such legal actions could have a significant impact on the overall economy? If so, to what extent? 


Statistics suggest that the value of claims arising out of the millennium problem is so great that there will 
be a significant impact on the economy. 


At the very least will be the cost of carrying out an audit to check whether all currently used software is 
compliant. If defects are identified, the further costs associated with remedying those defects either to re-write 
the code, update software or replace the all or part of the system will affect the economy. Old mainframes 
using the COBOL computing language are likely to have to be replaced entirely. The cost to the economy of 
preventative medicine, that is to say ensuring millennium compliance in advance of the year 2000, is likely to 
be considerably less than trying to restore a failed system and recovering corrupted data in the millennium. 


The most difficult area to estimate costs and consequently the impact on the economy is that of embedded 
software. Many electrical and automated products from household to factory equipment, contain embedded 
chips which may be affected by the millennium problem. The extent of loss caused by embedded software will 
only become apparent upon failure of those products or equipment and is very difficult to predict. Thereafter, 
the impact on the economy will be the ability of the supplier of those failed products to replace or correct 
them or not. 


3. Do you think that the public are sufficiently well protected by current consumer legislation? Is further legal 
protection needed to deal with year 2000 problems? 


Supply of Goods Containing Software 


The Sale and Supply of Goods Act 1994 which came into force on 3 January, 1995 brought in the implied 
term that goods must be of “satisfactory quality”. Goods, with embedded chips, or software will be covered 
by this legislation. In many cases, the supply of goods will also be governed by standard contractual 
principles. There may also be an express term in the contract to the effect that the goods will be fit for the 
purpose. The fact that it is the software element that will fail and cause the goods to fail is irrelevant to the 
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issue of liability. The consumer will be protected in the same way as he/she would be if the product failed for 
any other reason. 


In addition to this contractual liability, a person who suffers loss may also have a claim in negligence against 
the supplier or manufacturer if he can establish a duty of care. Most goods containing embedded software 
of a safety critical nature will support a claim in negligence. 


Both contractual claims and claims in negligence are based on establishing fault. The Consumer Protection 
Act 1987 allows a claimant a remedy for defective products which cause injury irrespective of fault but 
dependent upon the failure of the goods. Any person who suffers injury may claim under the Act. There is 
some doubt about whether this Act applies to computer software. 


Supply of Software 


As set out above there may be an express contractual term which sets out that the software is of 
“satisfactory quality”. There is some doubt as to whether software is “goods” although the indication given 
in the case of St Albans City and District Council -v- International Computers Limited [1996] 4 All ER 481 is 
that software is “goods” with the protection that this offers the consumer. 


In both the sale or supply of software and the sale of goods containing software, the consumer has to 
overcome the statutory limitation period hurdle. Claims must be brought within six years from the date of 
supply of the goods or software. This will affect all supplies of software six years before the year 2000. 


Consumers (like others) are also under a duty to mitigate their loss. This means that they must take all the 
steps they can to limit the losses which arise out of millennium non-compliant software. Any attempt by 
software suppliers to limit or exclude liability will be subject to the Unfair Contract Terms Act 1977 which 
puts such clauses under a “reasonableness” spotlight. 


4. What would be the legal position of a supplier of proven non-compliant goods if his insurance company 
had excluded non-compliance from product cover? 


The supplier of proven non-compliant goods which is uninsured will have to bear its own losses. This 
problem will be particularly acute amongst many smaller companies who do not have the resources to deal 
with the millennium compliance issues in a comprehensive manner. There is a real risk of business failure in 
the small business sector which may have a considerable impact on the economy as a whole. 


It should be emphasised that this note focuses on legal remedies available to customers. The fact that a 
legal remedy is available does not mean a consumer will always be able to enforce that remedy. In particular, 
where a supplier of defective goods is forced into insolvency procedures because of a multiplicity of claims, 
individual consumers are unlikely to recover from that supplier. For these reasons it is important to consider 
what measures can be taken to protect against the impact of millennium compliance on business failure in 
the small business sector. 


As at today’s date Wednesday, 25 February, 1998, there is only one year, 309 days until 1 January 2000. 
25 February 1998 


APPENDIX 49 


Memorandum submitted by Masons, Solicitors 


INTRODUCTION 


Masons is an international law firm with a leading reputation in Information Technology and Construction 
law and practice, and consequently we have received a wide variety of instructions from clients concerned 
about the impact of the Year 2000 problem upon their businesses and customers. 


SUMMARY 
— Weconsider that a substantial number of legal actions will arise due to the Year 2000 problem. 


— Such actions will be pursued by system users and users of equipment containing embedded systems? 
either to recover their costs in securing a replacement solution or where system failure causes severe 
business interruption, damage to property, personal injury or death. In the case of personal injury 
or death, the Health & Safety Executive is likely to pursue a criminal prosecution. 


We would be surprised if such legal actions or disputes per se will impact upon the UK economy. 





5 See “Embedded Systems and the Year 2000 problem. Guidance notes” published by the Institution of Electrical Engineers, 
Savoy Place, UK WC2R OBL which is regularly updated on their web site http:/www.iee.org.uk/2000risk. 
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RESPONSES TO QUESTIONS ASKED 


1. What type of legal action do you think will result from equipment failures at the millennium? 


We anticipate three types of legal action arising as follows: 


(i) a civil action initiated by a system user to recover its costs in implementing a replacement system 
following its own technical audit or receipt of advice from its supplier revealing that its existing system is not 
Year 2000 compliant—we have been instructed by a City of London institution in one such case; 


(ii) a civil action initiated by a system user where its own Year 2000 project has failed to reveal a Year 2000 
problem; there is system failure; a serious incident or accident arises and consequently the system user suffers 
substantial business interruption and/or damage to property and/or employees or visitors to the site are 
injured or killed; and 


(ili) acriminal prosecution pursued by the Health & Safety Executive under the Health and Safety at Work 
etc Act 1974, or other statutory regulations against employers, designers, manufacturers and suppliers® in the 
circumstances referred to in (ii) above where individuals are injured or killed. 


There are certain factors which will make civil claims by system users more or less likely (in no 


particular order) 
— The consequences or potential consequences of system failure caused by the Year 2000 problem. 
— The nature of the application which the system performs. 
— The date upon which the system was installed. 


— _ The degree to which the system will fail, under perform or malfunction as a consequence of the Year 
2000 problem. 


— The availability of a remedy to enable an existing system to be repaired. 
— The costs of a remedy or replacement solution. 
— The availability of I.T. resources. 


— The terms of the contract between system user and its supplier and other sub-suppliers in the 
supply chain. 


— The liquidity and financial resources of the system user and its supplier and other sub-suppliers in 
the supply chain. 


— The availability of insurance. 
— The degree to which system users are able to complete their Year 2000 project “on time”. 


Where civil claims arise they are likely to be multi-party, with each party in the supply chain seeking a 
contribution or an indemnity from its sub-supplier or, where an insurance policy is in place, from its insurers 
(see answer to question 4 in this respect). Management consultancies and other IT consultancies are at risk 
for negligent advice given in relation to the Year 2000 problem. 


Is the picture in the UK likely to be significantly different from other countries and, if so, why? 


We see no reason in principle why the UK should differ from other leading Western economies, although 
it is probably fair to say that there is more of a “claims culture” in the UK and USA than other civil law 
jurisdictions. 


2. Do you think such legal actions could have a significant impact on the overall economy? If so, to what extent? 


It is widely reported that most companies which are now undertaking Year 2000 projects have had to 


increase their cost estimates or budgets for remedying the problem. Should a substantial number of system 
users seek to pass on these costs to their suppliers, there will be a significant number of legal actions. 


Currently no-one (and certainly no law firm) can foresee the extent to which systems will fail; the precise 
consequences of failure and whether legal actions will result. 


We would be surprised if legal actions and disputes per se would impact the overall economy. 


3. Do you think that the public are sufficiently well protected by current consumer legislation? Is further legal 
protection needed to deal with Year 2000 problems? 


No comment as this is outside our area of practice. 





° See preface by HSE contained in “Safety and the Year 2000” (published by HSE Books, PO Box 1999, Sudbury, Suffolk CO10 
6FS. Price £15.00. 
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4. What would be the legal position of a supplier of proven non-complaint goods if his insurance company had 
excluded non-compliance from product cover? 


This would not affect the supplier’s potential liability to the system user for breach of warranty, depending 
upon the precise terms of the contract between the parties and the extent to which warranties might be implied 
by law. 


The non-availability of insurance cover (due to an exclusion) would however influence a Court in 
considering the extent to which a supplier’s limitation of liability clause passes the test of reasonableness 
under the terms of the Unfair Contract Terms Act 1977 (where applicable). In the case of St Albans District 
Council -y- ICL’ the Learned Judge took into account the availability of insurance cover for ICL and the 
absence of insurance protection for St. Albans in finding that ICL’s limitation of liability clause did not pass 
the test of reasonableness under UCTA and was therefore unenforceable. 


It is perhaps trite to state that the supplier would not be able to claim as an insured against its insurer under 
its insurance policy if it contains a Year 2000 exclusion clause. As the law stands, it is not open for the supplier 
to argue that such an exclusion clause is contrary to UCTA as insurance contracts are excluded from the scope 
of UCTA®. 


February 1998 


APPENDIX 50 
Memorandum submitted by the Consumers’ Association 


INTRODUCTION 


1. Consumers’ Association (CA), publisher of Which? and other consumer magazines and books is an 
independent consumer organisation with around 700,000 members. We receive no funding from government 
or industry and are financed solely by sales of our products. As an organisation relying heavily on information 
technology for research, data processing and subscription fulfilment, we have first hand knowledge of some 
of the difficulties that businesses may experience with millennium compliance. At the beginning of last year we 
initiated an audit process to ensure that our own computing and operating systems and embedded software in 
products and processes, and that of our suppliers, meets the British Standards Institute’s Year 2000 
Conformity Requirements. We also set up a project team to look at issues affecting consumers in general. 


1.2 Weare extremely concerned about the potential problems which may arise in the year 2000 as a result 
of software and systems which are not compliant. Much of the debate about potential problems has focussed 
on the potential impact on businesses, rather than the likely impact on consumers if companies have not taken 
the necessary steps to protect them. It has also been a matter of concern to us that much of the information 
currently available continues to be characterised by speculation and anecdote rather than well researched 
facts. We therefore welcome this Inquiry by the Science and Technology Committee and we appreciate the 
opportunity to submit evidence to the Committee. 


1.3 While the problem was initially seen by some as chiefly affecting businesses and IT suppliers, it has 
become increasingly clear that there may also be a significant impact directly on consumers, whether as 
purchasers of goods and services, for example, personal financial products, or as users of systems such as 
health or transport services. 


To deal with the questions raised in order: 


2. To what extent is the public at risk from non-millennium compliance exposure? 


2.1 The public is potentially at significant risk. It has been suggested that Year 2000 failure or malfunction 
in date-critical systems which support essential services could have life threatening consequences, for 
example in: 


— air traffic control and road and rail signalling equipment; 
— medical equipment or computerised patient records in hospitals and surgeries; 
— control equipment in factories, chemical plants or power stations, particularly near residential 
areas; and 
— processing, labelling and distribution of perishable foods. 
2.2 There is also the possibility of consumers suffering financial loss, major inconvenience or breach of ° 
data protection safeguards arising from malfunctions in, for example: 


— transaction, billing and credit-rating systems in banks, building societies, credit card companies, 
utilities and other businesses; 





7[1995] FSR 686 at pages 708 and 709. 
8 UCTA 1977, Schedule 1, Section I(a). 
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— insurance company records; 


— social security benefit administration, (concern relates particularly to elderly people during winter 
months, for example); 


— workplace salary systems or pension records; 
— local authority administration systems (affecting, for example, electoral rolls); and 


—  PEPS (in relation to the millennium compliance status of the companies in which funds are 
invested). 


2.3 In qualitative terms, therefore, some types of hazard could be extremely serious; what is not known is 
how major or how widespread any of these malfunctions will be in practice, and hence the degree of risk to 
the public in quantitative terms. 


2.4 It will also be evident that while consumers can take precautionary measures against financial and 
administrative Year 2000 problems of the type listed in the second group above, there is very little they can 
do about the potentially very serious failures in the first group. 


2.5 Inaddition, there is also the less serious but probably more widespread risk of malfunction in consumer 
equipment. As well as the many personal computers used in homes and small businesses, this could include 
such items as video recorders and telecom equipment with embedded date sensitive control systems. These 
raise issues of product liability which, while theoretically covered by existing legislation, may present 
difficulties for consumers in obtaining adequate redress. 


2.6 Over the past two years, we have, as a matter of course, tested for millennium compliance every 
relevant domestic appliance which we have tested for our Which? reports. To date, we have not found any 
problems. 


2.7 Wealso carried out a small survey in which we asked 500 Which? members to check their video cassette 
recorders (VCRs), watches and fax machines for any Year 2000 problems. To do this, they set the clocks 
forward on these products to see whether they rolled over to 1 January 2000. They then checked whether the 
products “recognised” the date 29 February 2000. Of the 187 replies we received, five watches, 10 VCRs and 
two fax machines experienced problems. For this reason, our concern about domestic appliances focuses 
chiefly on those products which consumers have already purchased. 


2.8 An important element of the problem for consumers is that in England, Wales and Northern Ireland, 
consumers have only six years from the date of purchase to bring a legal action for breach of contract against 
a retailer’ .It is therefore important for consumers who bought equipment four years ago to be aware of the 
opportunity to test that equipment and seek any necessary redress now, rather than waiting until the 
Millennium when the six year limit will have expired. 


3. Is enough being done to educate the public? 


3.1 No. A huge amount of information is available in print and on the Internet but almost all of it focuses 
on issues of technical and contractual compliance and litigation from the perspective of businesses and 
providers of IT solutions. There has been unhelpful alarmist reporting in the tabloid press. We think it 
important that consumers are not alarmed unnecessarily to allow companies to focus attention on assessing 
and dealing with Y2K problems, rather than dealing with thousands of letters and calls from customers. 
Nevertheless, there is an important balance to be achieved between not diverting resources from the problem 
and ensuring that consumers’ needs for information are met. Companies, government departments and other 
bodies have a vital role to play in educating consumers about the action they have taken to protect them and 
giving information about available redress. As the dates when computer problems are expected draw nearer, 
it will become even more important for companies to communicate with customers on this issue, and 
consumers will expect to be given more detailed information and assurances. 


3.2 Similarly, the Government’s Action 2000 programme offers informations and training advice to 
businesses but does not have in its remit responsibility for consumer issues. We have written to the Minister 
responsible for Action 2000 on a number of occasions to express our dissatisfaction with this serious 
omission. 


3.3, What more would you like to see done and by whom? 


We would like to see the Government take active responsibility for protecting consumers from the 
_ Millennium problem and, at the very least, to give consumer problems the same attention that they have 
addressed to those of industry. 


3.4 There is a need for a planned practical consumer information programme, to raise awareness, 
accompanied by a programme of consumer education on what consumers can do to minimise any impact if 
problems do arise. At a very basic level, this could be done by means of fact sheets, help lines and web-sites — 
the sort of initiatives that Action 2000 has introduced for business. 

a SE RE See Le ee ee Re ee OU MPS 


* Sale of Goods Act 1979, as amended by the Sale & Supply of Goods Act 1994. 
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There also needs to be a central source of information about consumer problems which can be used by 
journalists and others who have the potential to inform (or misinform) consumers on this issue. 


3.5 A planned consumer education programme should look at consumers’ information needs now and 
over the next two years. While such an information campaign should be co-ordinated by the Government, 
much of the information could be provided by manufacturers, retailers, banks, insurance companies and 
other suppliers of products and services. 


The education needs to take several forms: 


3.5.1 Consumers need information about their legal rights and any time limits for making claims for 
redress; 


3.5.2 For products which consumers already have in their possession, consumers need information about 
what sorts of products might be affected and how they can check them in advance of the century Date Change 
to see if there are problems. This is particularly important for products which are around four years old, for 
which consumers will not be able to claim compensation in 2000 for breach of contract by the retailer, but 
could do so over the next two years; 


3.5.3 For products which consumers are buying now, they need to understand any claims which are being 
made about the products in relation to the Millennium, for example, do the claims refer to the software or 
the hardware?; 


3.5.4 Consumers need information about what action they can take to minimise the problems which they 
may run into if a company has not taken the appropriate action (as set out below in our answer to Q4); 


3.5.5 Public bodies, government departments, regulators and industry should be encouraged to make 
publicly available, in a form which is understandable by consumers, information about their compliance 
activity and its progress, to help to ensure consumer confidence. 


4. What advice has CA offered its members? 


4.1 In January 1998, we published a Which? report, “Millennium Countdown’, which includes practical 
advice in a number of areas, for example: i 


— _ we have set out a number of actions which consumers can take to protect themselves, such as, 
keeping personal financial papers in order, including utility bills and checking insurance policies for 
year 2000 exclusions (a full list is set out in our answer to QS below); 


— We have explained consumers’ legal rights under the Sale of Goods Act 1979, as amended by the 
Sale & Supply of Goods Act 1994, and the Supply of Goods and Services Act 1982, the Consumer 
Protection Act 1987, unfair contracts legislation and the law of negligence. 


In addition, we have published details of telephone lines for our members to call us with information on 
problems they have experienced as a result of the Millennium bug. 


4.2 Our report pointed out that some services liable to be affected (such as NHS treatment or social security 
benefits) are supplied without contract making any claim for redress more difficult; and, as already indicated 
under Question 1 above, the most potentially serious Year 2000 problems are entirely outside the 
consumer’s control. 


4.3 Inanearlier Which? report!', we gave consumers information about some software packages designed 
to audit and/or fix home computer problems which had performed well in tests. 


5. Is there a need for consumers to be offered greater protection beyond that provided by current legislation? 


5.1 With regard to consumer goods and also services supplied under contract, existing legislation should 
in theory be sufficient to ensure that retailers meet their obligations to upgrade, replace or compensate, 
although for claims for breach of contract against the retailer this only covers equipment up to six years old 
(in England, Northern Ireland and Wales). The same problem should not exist for consumers in Scotland 
where consumers have a period of five years after damage to a product occurs in which to make a claim. This 
needs to be publicised and enforced, though, preferably by the DTI. We anticipate particular difficulties with 
personal computers in determining whether hardware or software is at fault. 


~5.2 Weare concerned that a number of retailers and manufacturers are making claims about Millennium 
compliance for their products as we think that there is scope for considerable consumer confusion. We would 
like to see Trading Standards Officers investigating these claims now. 


5.3 In addition, we raised concern with Action 2000 about their proposed introduction of a “Millennium 
Safe” logo, which companies could use if they felt they had taken appropriate action. We fear that without 
some basic consumer protection measures, such a logo could be used to mislead consumers by companies, 
particularly those who may not have appreciated the need to undertake a proper audit of their systems and 





'0 Not printed. 
11 “The Millennium Bug”, Which?, November 1997, pp30-31. 


224 APPENDICES TO THE MINUTES OF EVIDENCE TAKEN BEFORE 





processes. In our view, such a logo should at the very least demonstrate that a company has undertaken an 
identified procedure, such as a systematic audit and correction of software and embedded systems. Additional 
safeguards that we consider should underpin the use of a logo would be that its use should be signed off by 
a senior member of staff, for example, the Company Secretary. Those companies who use the logo should 
be required to register its use with an authorising body (such as Action 2000) and be prepared to produce 
documentary evidence to back up their claim if requested. In addition, a clear definition of what is meant by 
“Millennium Safe” is needed to help consumers in obtaining redress at a later date if necessary. 


5.4 As already noted under the answer to Question 3, above, there is greater cause for concern in the case 
of state or other services supplied on a non-contractual basis. Although a consumer might still have a valid 
claim for negligence if they suffered loss or injury due to Year 2000 problems, this could prove difficult, time 
consuming or expensive to substantiate. 


5.5 In September 1997, CA contacted 15 regulatory bodies and agencies to ask what action they were 
taking to protect consumers from Year 2000 problems. Replies showed that some were still in the early stages 
of dealing with the potential problem. Even where they said they were putting pressure on their respective 
industries to meet targets for millennium compliance, they had not in most cases considered the issue of 
consumer redress if failures or other problems arise. Nor has there been any clear statement concerning the 
passing on of compliance costs to the consumer. It would be unacceptable if consumers are expected to bear 
the cost of the company inefficiencies in relation to this problem. Regulators must accept that they have a 
role to play beyond normal standards of service regulation, and CA plans to monitor this issue very carefully. 
We are concerned that some Regulators may hold that setting normal standards of service is sufficient to 
guarantee that companies take action to deal with the Year 2000. This would clearly not be the case if 
companies are not aware of the potential impact of Y2K on their service delivery or are not aware that 
Regulators will take an interest. Regulators are uniquely placed to take action and we would like to see them 
play a proactive role in ensuring consumers do not suffer as a result of inaction by companies. 


6. What should the Government be doing to encourage consumers to make appropriate preparations? 


6.1 As already indicated in the response to Question 2, in our view there is a need for a planned programme 
of consumer education which could include measures such as media advertising, fact sheets, helplines and 
web-sites. In other words the sort of initiatives that Action 2000 has introduced for businesses. There should 
be a planned strategy co-ordinated by the Government as part of its “Millennium Bug” campaign. This 
strategy should not, however, be restricted to specific precautionary advice but should also seek to maintain 
consumer confidence by including up to date progress reports on compliance measures by government and 
industry in the key areas identified in the answer to Question 1. 


6.2. What appropriate preparations should consumers be making? 


We will continue to keep under review the sort of preparations which consumers should be making, in the 
light of information which becomes available about the progress being made by government departments, 
industry and other organisations in tackling the problem. We may also advise action in the light of calls and 
letters from Which? members about any problems they are experiencing with products or services. At the 
moment we are advising consumers of the following; 


Action which consumers should consider to protect themselves from possible problems: 


— keep financial papers in order, for example, keep records of when insurance policies are due for 
renewal, keep details of direct debits and mortgage repayments; 


— keep receipts of financial transactions made abroad, in case there are problems with the computer 
systems in that country; 


— if you receive a credit card with an “00” expiry date, make sure you keep all your transaction slips 
and check them against your statement; 


— keep your utility bills, so that you have proof of meter readings, for example, in case there are 
problems with billing systems; 


= if you are buying or renewing an insurance policy, check with your broker or insurer to see whether 
it has any Year 2000 exclusions. As policies such as household or car insurance are annually 
renewable, exclusion clauses may only start appearing in early 1999; 


— be careful if you are buying an extended warranty. Year 2000 exclusions may make the policy 
virtually worthless; 


— _ there are some products you can test at home, such as VCRs and fax machines by setting the clock 
to roll over from 1999 to 2000, and then seeing if it recognises the leap year; 


— if you discover that any products are not year 2000 compliant, refer back to the retailer. Remember 
that in England, Wales and Northern Ireland you can only claim compensation for breach of 
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contract during the six years from the date of purchase. So if you have a four-year old product that 
is not compliant, it is best to contact the retailer now; 


— if you have concerns at your workplace, ask what action is being taken. For example, check that 
plans have been made to ensure that your pension scheme contributions will continue to be 
picked up; 


— if you are making a purchase over £100, it may be worth using a credit card to gain the extra 
protection provided under Section 75 of the Consumer Credit Act 1974, which specifies that the 
credit card companies are jointly liable for the retailer’s breach of contract or misrepresentation if 
you buy faulty goods or services; and 


— check whether travel insurance policies exclude Year 2000 failures. 
February 1998 


APPENDIX 51 
Memorandum submitted by the London Ambulance Service 


INTRODUCTION 


1. The London Ambulance Service (LAS) covers an operational area of 620 square miles, broadly aligned 
with the M25 boundary. Nearly seven million people live in the capital and their numbers are swelled by 
-around one million commuters who travel into London by tube, train and car during the rush hour. LAS 
provides patient care annually for one and a half million patient journeys, of which approximately half a 
million are conveyed by the accident and emergency fleet. 


SUMMARY 


2. The LAS has set up a Year 2000 project using the PRINCE methodology, with commitment at the 
highest possible level. The project does not restrict itself to internal risks. It also identifies that external 
organisations that LAS relies upon to provide service may fail to fully address the Year 2000 problem. The 
project plans make the assumption that there will be such difficulties, and that the LAS should seek to 
minimise their impact. Many risks to the project have been identified; however the major contraint is expected 
to be retention of sufficiently qualified staff, especially when the rest of the IT industry wakes up to the scale 
of the problem. 


BRIEF INFORMATION 


3. The LAS treats this project as of the utmost importance, and commensurate with this, has set up a 
PRINCE project on which the Executive role is undertaken by the LAS Chief Executive; the Senior User is 
the Director of Finance and Business Planning; the Senior Technician is the Director of Technology, 
redoubtable in the Information Technology field, being a Fellow of the British Computer Society; and the 
overall Project Manager has 25 years IT experience covering the private as well as public sector. 


4. As can be seen, LAS has established a project with a very high profile sponsor. It has also created a 
multidisciplined team to undertake a full inventory and scope of the problem; contact suppliers, analyse 
contracts, identify suppliers’ solutions, assurances and their test results; if appropriate run our own tests 
and/or procure replacements. 


5. Whilst the underlying problem is technology related, it needs to be appreciated that the potential 
consequences are upon service delivery and therefore upon patient care. To fully address not only the 
potential problem but also the potential impacts, the Project Manager has a team which includes 19 Senior 
Managers or Directors within the LAS, each chosen for their specialist knowledge and experience, and of 
which only five are from the Information Technology field. 


6. LAS works to timescales laid down by the NHS Executive in EL97(59) dated 3 October 1997, which 
require that by 31 March 1998 the LAS reports to the Regional Head of Information with: “Detailed Year 
2000 project plans, timescales for main phases, detailed budgets for remedial actions and how they will be 
funded”. 


7. In line with this timescale, LAS is currently undertaking an inventory of all of its systems, including 
writing to suppliers and establishing the costs and timescales of putting right those that are not compliant. 
It is necessary to undertake the inventory to identify all equipment that might possibly be subject to the Year 
2000 problem (ie contains or it is suspected may contain a computer chip), identify whether it is, and if it is, 
assess the impact and fix the problem, either by correction or by replacement. An initial budget figure of £1 
million has been identified and included in LAS financial plans. This figure may be subject to revision 
depending upon the results of the inventory and its state of Year 2000 compliance. 


8. The process is: using standard proforma, write to the supplier to confirm if the product is Year 2000 
compliant. If the supplier confirms that it is compliant, ask for test results, and if possible independently cross 
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check/validate the results. If the supplier confirms it is not Year 2000 compliant, ask what they are going to do 
to make it compliant . . . and if necessary plan to upgrade or replace . . . in either case, test and check results. 


9. In some cases, there are tools available which can be used to help, for example to test compliance of 
BIOS in PC’s. Where available and proven, these tools should be used to maximise the accuracy of the test 
results. 


10. In some cases, other parts of the NHS or other public bodies may have already undertaken the same 
or similar checks. Great care needs to be taken to ensure that their environment is an exact match to LAS’s, 
and in all cases, confirmatory test results are required. This option is being investigated further at a National 
Ambulance Forum to be held on 3 March 1998. 


11. Since broadly the products being investigated are mutually independent, the project is being progressed 
using concurrent Stage managers, each to establish their own project and Project Assurance team. Great care 
needs to be exercised on areas of actual or potential overlap, including LAN/WAN infrastructure. 


12. It is recognised as vital that LAS quickly identifies what systems needs to be replaced and reserves 
“slots” in its suppliers’ order book. 


13. The above details only internal risks. There is also the risk that external organisations may fail to fully 
address the Year 2000 problem. The LAS Year 2000 Project makes the assumption that there will be such 
difficulties, and that LAS should seek to minimise their impact. Hence during the subsequent stage (laid down 
in EL97(59) as by end 1998), detailed contingency plans are to be drawn up against each of the identified 
failure scenarios, both of internal and external providers. LAS project plans formally document as an 
assumption that there will be failures of external suppliers. 


14. For example, LAS has identified that if the Millennium problem causes failure of the electricity supply, 
there would be difficulty in fuelling the ambulances. This problem is seen as common to fuelling all of the 
emergency service vehicles in London, and LAS has therefore escalated it to the London Emergency Services 
Liaison Panel for a unified approach for emergency services in London. 


15. There is no doubt that the problem of the “Millennium bug” has not been adequately communicated 
to date. It needs to be appreciated however that this is a world-wide, not just UK problem. For example, the 
LAS has received written confirmation of Year 2000 product compliance from one multinational company, 
based on testing undertaken by their US parent. LAS was aware from our internal testing that this was not 
the case, and asked for copies of their test data sets and test results. LAS has helped that company by 
identifying the failure/inadequacy of their test data sets, and that company now appreciates that their product 
is not Year 2000 compliant. 


16. To how many more companies and products does this apply, and will the users of these products be 
as technically aware and adept as are LAS technology staff? 


17. Itis recommended that Government write at the highest level to every known IT provider and to every 
known UK user of technology, perhaps drawing upon the knowledge and experience of the LAS. It is 
suggested that this be underpinned by personal invitations to captains of industry and decision makers to a 
seminar to be chaired by a Cabinet Minister, to outline the potential problems and issues, followed by a Brains 
Trust Question and Answer session. 


18. Assuming that LAS is not alone in deciding to cover itself against possible failure of the supply chain, 


that is by building up stocks of all consumables in the latter half of 1999, there could be an impact on the: 


economy, as organisations generally bring forward their spend. There are three perceived impacts upon the 
economy: the early spend may impact upon borrowing; the supply chain may expect to encounter a mini- 
boom, mini-bust scenario; the increased demand in the second half of 1999 may make it that much more 
difficult for the supply chain to address its own Year 2000 problems. 


23 February 1998 


APPENDIX 52 
Memorandum submitted by Annodeus Limited 


1. INTRODUCTION 


1.1 Annodeus Limited is a wholly owned subsidiary of Acclaim Entertainment Limited, a global 
entertainment software corporation established in 1987. Annodeus draws upon Acclaim’s significant 
software skills and development experience and, importantly for the millennium issue, a key skill-set in system 
clock management within a range of computing environments. This led to the development of its Year 2000 


product concept, the launch of Annodeus and a strategic step into business solutions software for the 
corporation. / 


|e Annodeus has spent the last 18 months developing Solution 2000—a range of products and services 
to help businesses assess and address Year 2000 compliancy issues, scalable from the largest multinational 
corporations down to the single personal computer. 
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1.3 Solution 2000 is the first in a range of solutions aimed at the desk top environment that will address 
wider business needs. For example, Annodeus is already developing software that will help businesses manage 
the technical and business changes arising from European Monetary Union. 


1.4 Adopting a broad, long-term strategic approach to solutions and intelligence-based technologies 
distinguishes Annodeus from many of its competitors, who are entering a short-term market created by the 
Year 2000 issue. The substantial investment (over £600,000 to date) made by our parent company, in parallel 
with a focus on quality standards and significant due diligence in choosing advisors, is key to the arguments 
we present overleaf. Annodeus remains to be convinced that other entrants to the Year 2000 solution market 
have demonstrated a similar level of commitment and responsibility. 


1.5 Asa result of this, Annodeus believes that Solution 2000 is the premier product in its category. This has 
been supported in a report by one of the leading independent authorities on the Year 2000 problem, Solace 
Consultancy Services. It rated Solution 2000 one of the top products in all areas of testing. In addition, Solace 
provides independent auditing for the company’s compliancy database, which is the largest of its kind and 
the only one known to be independently verified by a reliable third party. 


2. EXECUTIVE SUMMARY 


2.1 As a supplier of relevant solutions, Annodeus wishes to contribute to the debate concerning the 
millennium compliancy issue. In Annodeus’ view, the issue remains largely misrepresented as a technology 
problem, and instead must be approached primarily from a business/economic perspective. Annodeus aims 
to assist the Government in framing the issue clearly, and providing practical assistance to UK businesses. 


2.2 In summary, Annodeus believes that since all individual technical date change problems are solvable, 
the critical need is to ensure that companies put “millennium management” processes in place. Before they 
can do this, they must understand the true potential implications of the date change technical problem, which 
extend to the business and commercial environment, and in addition, among others, incorporate legal and 
insurance issues. 


2.3 The key to enabling these necessitates rapid action by the Government to re-frame its handling of some 
of the millennium issues. There must be more emphasis on practical assistance, the introduction of defined 
compliancy standards, a re-evaluation of the information sources and specifically, the advisors upon which 
the Government is currently relying. 


2.4 Annodeus’ key recommendations can be summed up as follows: 


— Annodeus believes that action must be taken now to address this issue, as we are fast approaching 
the millennium and time is literally running out. The awareness generation process is excellent, but 
insufficient: “Stop talking: start doing” 


— Many companies and individuals claim to offer solutions and best practice advice. But Annodeus 
urges the government to establish an accreditation system for solutions providers. It needs to 
establish and acknowledge practitioners of best practice, lest a false sense of security stacks up 
unresolved problems for the date change timeframe: “Choose your partners carefully” 


—  JItis entirely likely that the range of problems already identified could recur at a later stage, so the 
government and the business community must be prepared. This includes acknowledgement of the 
shared responsibility to address such problems, as well as the practical steps towards managing such 
issues. Annodeus itself is already developing solutions to manage the technical and business changes 
arising from European Monetary Union: “Establish pattern for the future” 


3. RESPONSES TO SPECIFIC POINTS 


(i) the nature, magnitude and implications of an inability to manage the date change in personal and mainframe 
computers, embedded systems and software, especially where such computers are performing safety critical 
operations; 


3.1 The phrasing of this question illustrates a fundamental problem that is shared by government and the 
business community alike. 


Buk Every single individual technical problem, whether in software, hardware or embedded systems can 
potentially be solved given sufficient time and resources. 


3.3 The nature of the Year 2000 problem is actually an inability to manage the process of tackling these 
issues within the timeframe available. This arises both from the sheer scale of corporate and government 
systems, as well as the well-documented lack of awareness that the problem exists within sections of the 
business community, in particular SMEs and very small businesses. 


3.4 A further causal factor is potentially the most serious. That is, lack of understanding that no system 
exists in isolation. Universal compliance, if it is achieved, is meaningless without understanding the 
interdependencies your system and or business shares with other (non-compliant) systems. 
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3.5 As a result, the magnitude of the “millennium issue” is impossible to quantify. Therefore, direct 
implications are impossible to outline to any significant degree. The “knock-on” effects of business and 
technical interdependencies may only be known after the date change. 


3.6 Annodeus supports the Government in its awareness raising activities, however, we believe that it must 
take technology out of the equation to a large degree, and immediately commence providing practical 
guidance to ensure that the problem is tackled. The size of the problem is, to some extent, immaterial. 
Immediate action is critical but will only happen if practical recommendations are offered, based on clear and 
concise guidelines. 


3.7 Annodeus has developed concrete proposals to work with sections of the public and private sectors to 
tackle the millennium comphancy issue. : 


(ii) the effectiveness of action which has already been taken to avert problems in Government, large corporations 
and small businesses; / 


3.8 All action taken or underway to address date change probiems within individual systems is a step 
towards the readiness of these organisations. However, it cannot and will not avert the economic, 
organisational and commercial problems that will impact the UK on | January 2000. Annodeus does not 
therefore consider this action effective. 


3.9 Again, Annodeus re-iterates that the problem should be approached from the wider business and 
economic perspective. Technical plans of action are important, but the focus should be on preparedness to 
face and manage the host of non-technical problems which are currently being ignored or side-lined in favour 
of IT planning. Effective action will only be that which addresses and prepares for the business and 
commercial implications of the date change, in addition to the technical. 


Amongst others, the Government must include consideration of: 


— Commercial implications—the potential for total collapse of our commercial system is a reality. As 
financial institutions prepare to protect themselves and assess the risk of their own lending, small 
and medium sized business credit is tightening, and will do so further leading to some business 
failures. Warehousing/distribution of all consumer and industrial goods is at risk, as each single 
problem will impact entire supply chains of businesses due to the interdependent nature of the 
economy. The knock-on effects of non-compliancy will be excessive. 


— Legalimplications—in addition to assisting thousands of IT supplier companies to frame their Year 
2000 “get-out” clauses, the legal profession is gearing up for a “boom” in professional and 
commercial liability cases, as a result of supply-chain problems, public/consumer safety claims and 
a host of other issues. This is fuelled by the ambiguity regarding compliancy standards and practical 
guidance for businesses. 


— Insurance implications—this industry is focusing on self-protection as it becomes aware of the 
infinitely large potential claims arising. Minor and major systems failures will affect public safety, 
lead to personal financial losses, business collapses, personal liability for company directors, and 
many other issues. Already, companies are signing annual insurance renewals which specifically 
exclude coverage for losses arising out of the Year 2000 date change, without real understanding of 
the implications. 


— Social and consumer implications—arising from failure of systems in the home, household utilities, 
safety systems, transport, personal banking and others. 


4.0 To be effective, the Government must address the problem of how to ensure commercial and economic 
stability for the country, and share responsibility for this within European and global markets. We believe it 
holds a duty of care to acknowledge this responsibility, cascade and manage shared responsibility throughout 
the UK business community, as a key element of its millennium action. 


| 


(iii) the role of government in raising awareness of the potential problems and in seeking solutions and the 
respective roles of Taskforce 2000 and the recently launched Action 2000; 


4.1 Annodeus applauds the leading role the Government has played in raising awareness of the technical 
issue, and it is clear that at some levels (in some large corporate enterprises) this has stimulated action. 
Taskforce 2000 was successful in focusing attention on the broad problem, and was effective in encouraging 
some organisations and individuals to consider how they will address millennium preparedness. The better- 
funded Action 2000, with a more business-orientated remit, will undoubtedly play a key role in promoting 
awareness in the SME community. 


4.2 However, Annodeus shares some of the concerns voiced in the media. Firstly, whether this initiative 
is sufficiently prioritised, as illustrated by the appointment of a part-time director, able to devote only one 
day per week to the organisation tasked with averting a potential national catastrophe. This undermines the 
Government's claim that it is committed to doing everything possible to tackle this issue. 
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4.3 Secondly, Annodeus questions whether the Government has undertaken sufficient due diligence to 
ensure that its advisors and information sources are the best available. Annodeus also queries the 
appointment of an official advisor with commercial links to a solution product—the effectiveness of which is 
questioned. 


4.4 Annodeus recognises the requirement for absolute diligence in ensuring its own products and services 
are unassailable. Annodeus’ actions have included engaging senior level legal advice through Clifford Chance 
and top technical law firm Bird and Bird, ensuring that products and compliancy knowledge-base are 
independently audited and verified. All Annodeus’ operations are therefore to the level of or above the ISO 
9000 standard, and we adhere to the most rigorous compliancy definitions yet developed. 


4.5 Thirdly, despite offering “direct support for SMEs to help them translate their awareness of the 
problem into action” there is little action evident—once more, the focus appears to be on talking up the issue, 
although the government is offering to act as a “link” between business solution providers. However, even 
this linking carries a rider, in that the government is carefully avoiding providing concrete recommendations, 
or approvals or certification of suppliers. 


4.6 Fourthly, Action 2000 has created an effectively meaningless “kitemark” system, to be applied by 
businesses to their products when they reach a level of confidence about product compliancy. This is purely 
self-determined, and there is currently no clear definition of millennium compliance. Annodeus feels that this 
may therefore be actively detrimental to the overall drive towards true problem resolution, create a false sense 
of security, and encourage “near enough” attitudes. Annodeus considers the compliancy definition issue itself 
in detail overleaf. 


(iv) the extent to which new systems and software are millennium compliant; 


4.7 Annodeus believes that it is impossible to assess the extent to which any new or existing systems or 
software are millennium compliant, without a definition of millennium compliancy. Neither the UK 
Government nor the European Union has ratified a definition of compliance, and in Annodeus’ view this is 
a fundamental step towards effective action of any kind. Annodeus commend to the Government the British 
Standards Institute definition, and the outline of technical compliancy provided by Solace Consultancy 
Services. 


4.8 A clear benchmark is required before we can be confident that any new systems and software are 
compliant, let alone those systems currently in use. All diagnostic activity, whether manual or automatic, 
requires a standard against which compliancy can be measured. This must be consistent across all diagnostic 
and problem fixing programmes in order to achieve a level of confidence in the results and any resulting 
certification. This would also clarify the position for legal and insurance purposes. 


4.9 Self-determined compliancy statements issued by vendors of software or systems are meaningless 
without third party verification. They will give rise both to a false sense of confidence and potential legal 
liability/insurance issues arising. It is unlikely that business insurance will cover a company whose systems 
fail because they have taken a vendor’s assurance to be correct, and it is certain that the insurance industry 
will include this qualification. Financial liability of company officers might potentially hinge upon a single IT 
purchaser taking a system vendor’s assurance to be absolute. 


5.0 Compliancy measurement must also take into account the effect of interdependency of different 
systems—for instance, a compliant PC running non-compliant application software will, overall, be non- 
compliant and subject to date change failure. Similarly, a network running on a compliant server or 
mainframe computer, with a compliant operating system, and compliant application software, will be non- 
compliant ifa single PC on the system is non-compliant. These scenarios, as well as illustrating the complexity 
of the business problem, also act to make the effectiveness of vendor assurances null and void. 


5.1 Recent press reports have suggested that a large proportion of new consumer systems are still non- 
compliant: for example, a recent report in The Sunday Times reported that 80 per cent of the personal 
computers sold in Dixons are non-compliant. Firstly, these have been measured against an unknown 
compliancy standard. Secondly, this illustrates a further issue with new equipment supply: although many 
manufacturing companies claim that “all new computers” will be millennium compliant, products in the 
supply pipeline (factory inventory, warehouse inventory, shop inventory) are older stock. Inevitably, the 
home and small business consumer is continuing to purchase non-compliant systems, and will continue to do 
so for some time to come. 


5.2 The rate at which new products are coming to market presents a further problem for millennium 
managers. It calls into question the value of many databases, reference guides, and information sources about 
millennium compliance of commonly used products. Annodeus has committed to continual rewrite of its own 
products, and continual expansion of its auditing database, to ensure that it remains the most reliable source 
of data on product compliancy. With over 39,000 products currently listed, it is the largest known database 
of compliancy, based upon the BSI and Solace standards. 


5.3 To ensure that our products remain at the cutting edge of quality, we have submitted our products to 
both the National Physical Laboratories and the US-based National Software Testing Laboratory (NSTL) 
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for comprehensive testing. Annodeus believes that it is this commitment to quality and development which 
has convinced blue chip companies such as NCR, ECS/Société Générale, among others to work with us in 
tackling the millennium compliancy issue. 


(v) the development of contingency plans in the event of system and programme failures; and 


5.4 In the light of our preceding arguments, we believe that effective contingency planning on a national 
basis is not only premature, but impossible. Both the government and all individual businesses should 
certainly be developing contingency plans at this late stage, but are simply not yet equipped to do so due to 
lack of appreciation of the above issues. 


5.5 There is no clear definition of the problem. There is no established system for measuring the problem, 
or defining areas of our national technology which are or will become safe. There is also too wide an 
interdependency network to accurately predict the effects of the date change. There is therefore no idea what 
we will be recovering from. 


5.6 Annodeus believes that the priority today is to establish a clear plan of action, and provide practical 
help to minimise the risk of major technical and business system failures. 


(vi) the legal implications of disputes over liability for compliance costs and system and programme failures” 


5.7 In the absence of any accepted uniform compliancy standard, it is impossible to assess the legal 
implications of disputes arising from system failures. For proof, one only has to look at the current level of 
concern amongst insurers, and the rapid re-writing of insurance policies for every Y2K contingency. 


5.8 Considerable damage will arise from the prevalent lack of awareness that there are legal issues and 
liability risks arising. In the coming months, businesses will face a critical question: how do you insure against 
the unknown? The legal industry will prepare for potentially the biggest boom in their history, while the 
insurance industry continues to batten down the hatches to protect their existence. In this scenario, every 
British business will be a loser, whether they are individually compliant or not. 


5.9 The Government is the only body in the UK which can break this deadlock, and we strongly 
recommend that this becomes a further priority area for action. 


6.0 It is essential that a pattern for addressing issues such as this is established now. We are beginning to 
see recognition of the potential issues arising from the implementation of European Monetary Union, which 
will share many of the procedural problems associated with the millennium problem. This is not a one-off 
issue as further date change issues are brewing—when the real “millennium” starts, and further key dates in 
the future. 


22 February 1998 


APPENDIX 53 
Memorandum submitted by the National Health Service Executive 


BACKGROUND 


1. The National Health Service is one of the largest users in the UK of computer-based devices and, of 
course, many of these are concerned with direct patient care. 


2. The problems associated with the change of millennium (and related dates such as 9 September 1999 
and 29 February 2000) affect the NHS in the same way as all other organisations. However, there are two 
areas of particular significance which are shared by some—but certainly not all—other organisations. These 
are the safety critical nature of many computer systems and the large number of devices with “embedded 
chips”, such as infusion pumps. 


3. This Memorandum to the Science and Technology Committee indicates the actions that have been 
taken to date in the NHS in England and planned future work. 


EXECUTIVE LETTERS 


4. The NHS Executive is fully aware of the seriousness of the problem and has issued two Executive Letters 
(EL(96)80 in August 1996 and EL(97)59 in October 1997), together with Health Service Guidelines 
(HSG(97)40, issued along with the latter EL). The second EL made it absolutely clear that this matter was 
of the highest priority and that Chief Executives should take personal responsibility for overseeing the 
arrangements within their organisation. I attach copies of these documents for ease of reference. 


5. The EL required completion of initial project plans by 30 November 1997. By 31 March 1998, NHS 
Organisations are required to complete detailed project plans (including details about how and when 
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contingency plans will be developed), detailed inventories and budget estimates. By 31 December 1998, all 
critical systems are required to be ready and fully tested, or detailed plans made for coping without those 
systems or equipment that cannot be repaired or replaced in time. 


FUNDING 


6. There is, at present, no definitive figure for the costs of rectifying these date problems. Figures between 
£100 million and £500 million have been suggested, although for planning purposes, a figure of £350 million 
has been assumed. After NHS Organisations have submitted their costed plans by the end of March 1998, 
more accurate figures will be available. 


7. It is the NHS Executive’s policy, in line with the Government’s overall policy, that all costs associated 
with the “Year 2000” problem must be met from existing resources. 


CENTRAL RESOURCES AND ACTIVITIES 


8. A project was set up within the Information Management Group of the NHS Executive in mid-1996. 
This was significantly extended in mid-1997 with the incorporation of the Acute Provider Centre as a “Year 
2000 Task Force” and additional financial resources. 


9. The principal purpose of this central team is to provide advice, information and assistance to NHS 
Organisations. Large quantities of various information packs have been distributed to Health Authorities, 
NHS Trusts, GPs, etc. 


10. Two “exemplar” sites have been chosen and the results of detailed studies of good practice at these 
sites are being widely disseminated. Further “exemplar” work will focus on specific issues such as contingency 
planning and embedded devices to provide further detailed information to the Service over the next few 
months. 


11. A Helpline at the NHS Executive’s Information Management Centre has been in existence for some 
time and is successfully responding to a considerable increase in queries. 


12. A World-Wide Web site has also been in existence for some time but has now been extensively revised 
and is being used to disseminate information and guidance to the NHS, although the information is freely 
available to other organisations and, in particular, to suppliers to the NHS. A database will very shortly be 
available on the site to provide detailed status information on a larger number of systems, devices and services 
together with full contact information for users, manufacturers and suppliers. 


13. A high-level Steering Group (now chaired by Neil McKay, Regional Director of Trent Region) has 
been set up to co-ordinate the activities of NHS agencies and other central organisations (eg Medical Devices 
Agency, NHS Supplies) and the NHS through the Executive’s Regional Offices. The “Year 2000 Task Force” 
is collaborating closely with all these organisations. 


14. The major suppliers of products and services are being contacted for information centrally using the 
appropriate knowledge and expertise of the central organisations. Meetings with several IT system suppliers 
have already taken place and information will be published in the next few weeks. 


15. Training courses have been developed specifically for those involved in NHS Year 2000 projects 
covering topics such as project management, risk management and contingency planning. The main Year 
2000 events for March include a forum for ambulance trusts and a workshop at HC’98, the largest healthcare 
IT Conference in the UK. 


LOCAL AND REGIONAL ACTIVITIES 


16. The activities of NHS organisations are being monitored through the Regional Offices as part of the 
normal performance management process. All NHS organisations have projects underway and, with initial 
plans in place, are now actively producing inventories and developing resource estimates. 


17. A full awareness programme throughout the Regions has been completed and specialist training is now 
proceeding. Further seminars on specific topics are being planned. 


NATIONAL AUDIT OFFICE INTEREST 


18. The National Audit Office have undertaken a survey of NHS organisations by questionnaire. They 
have also conducted a review in the Primary Care sector. The reports are in draft. 


MAJOR CONSTRAINTS 


19. The Committee requested information on the major constraints on the organisation which may hinder 
work in this area. The main potential constraints are: 
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— Priorities: The NHS has an extremely heavy work programme in meeting the increasing demand for 
its services and in implementing new policy initiatives (such as the recent White paper, the new 
NHS) which are also of high priority. The NHS Executive’s letter stated that the solution of the 
millennium problem was the “highest non-clinical priority”. 


— Resources: The availability of financial and skilled human resources poses a constraint on the NHS, 
as it does for most organisations. As noted above, the NHS has been asked to identify the required 
financial resources from within existing and planned allocations, and fullest use is being made of 
existing “in-house” NHS specialist advice. 


20. Magnitude of the task: Even if sufficient resources were made available, it is unlikely that every single 
piece of computer-based equipment could be thoroughly checked and where necessary, replaced or the fault 
corrected. Even if this were possible within NHS organisations, there are many suppliers on which they rely, 
to a greater or lesser extent. For this reasons, a vigorous approach to prioritising the necessary work is being 
taken to ensure due focus on safety-critical systems. 


CONTINGENCY PLANS 


21. Whilst it is expected that the majority of systems will be checked and vigorous steps taken to secure 
the supply chain, a major component of the NHS strategy to deal with this problem is the provision of 
contingency plans. Such plans are required to be submitted to the NHS Executive by 31st December 1998. 


22. The consequences of failure of date dependent systems and devices will vary very substantially, 
depending on the function of the system. Some failures may be life-threatening while others may not even be 
noticed. As already noted, NHS organisations are being required to prioritise their efforts depending on the 
degree of risk for each system. 


GOVERNMENT ACTIONS 


23. The setting up of Taskforce 2000 raised general awareness, mainly in the Press, and was useful in 
reinforcing the messages put out to the NHS by the Year 2000 Team. There was a significant delay before 
Action 2000 was launched but its focus is on small to medium enterprises (SMEs). GP Practices are examples 
of SMEs but GPs are likely to consider Action 2000 to be less relevant to them than the work of the NHS 
Executive Year 2000 team and, of course, Action 2000 will provide less targeted advice. 


10 March 1998 


APPENDIX 54 
Memorandum submitted by KPMG 


COMMERCIAL PROPERTY—WHERE WILL THE MILLENNIUM BUG BITE? 


The Property IT Team of KPMG, located in Canary Wharf, consists of accountants, chartered surveyors 
and IT specialists with a strong focus on the commercial property industry. We use this blend of expertise to 
consider the possible impact of the Y2K bug on commercial buildings. KPMG have tried and tested 
methodologies for dealing with the Y2K bug which are tailored to suit the needs of commercial property 
clients. 


There are generally three main areas of concern for any business: 
1. IT systems. 
2. Third party software. 
3. Embedded systems. 


Although we provide advice on all these three areas, this note concentrates solely on embedded systems in 
buildings as we understand this to be of particular interest to the Millennium Select Committee. 


In essence, embedded systems are systems which contain read only memory chips where the functionality 
is not accessed directly. These microchips have software embedded into them. The embedded systems are 
commonly used for monitoring, assisting or controlling equipment and can be generally categorised into 
two types— 


Large Systems: Lifts, CCTV, Fire Alarm/Detection, Air Conditioning, Boilers, Security, Intruder Alarms, 
Building Management Systems (BMS), Car Parking, Access Control, Telephone Exchange, etc. 


Small Stand Alone Systems: Photocopiers, VCR’s, answering machines, fax machines, printers, etc. 


Expert opinion is that about/S—20 per cent of embedded systems in a building are likely to experience a 
problem with Y2K bug. The issue is which of the systems are going to fail, in which area and with what 
consequences. To get suppliers of these systems to give Y2K compliant certification can be difficult 
(sometimes impossible) and time consuming. Also, if the system is business critical, it may be unwise to rely 


THE SCIENCE AND TECHNOLOGY COMMITTEE 233 





solely on such a guarantee. Business managers would be well advised to instigate their own comprehensive 
investigations and develop contingency procedures. 


Embedded systems pose a different (perhaps more complex) problem than IT systems do. Firstly, it may 
not be immediately apparent that a piece of equipment contains an embedded system. Once an embedded 
system has been identified in a building it is necessary to focus on who is legally responsible for ensuring the 
equipment operates correctly beyond Y2K. This, in itself, is not straightforward, as the equipment may rely 
on, or donate information to, other embedded systems which may fall under a different area of responsibility. 
In most cases the landlord has a responsibility, under the lease to keep the premises insured. Insurance policies 
may become invalid if safety or security related systems—such as fire or intruder detection systems—fail to 
operate correctly. Tenants also have a legal responsibility to ensure their employees are working in a safe 
environment. 


Once the likely problem for which you have a direct responsibility has been identified, it needs to be 
assigned a level of criticality to the business eg 1: Business Critical 2: High Level of Impact 3: Medium Level 
4: Low Level 5: Not Important. This will help rationalise the approach taken in later stages. It is imperative 
that businesses then quickly focus on the systems that are of the most importance, as the Y2K project can be 
time-consuming and large organisations may already be short of time. It may be necessary to study the work 
patterns and functions that are related to the system in question, so that knock-on effects of system failure 
can be fully judged. This may also uncover possible alternative solutions of by passing the system in the case 
of failure (“workarounds”). 


A dialogue needs to be established with the suppliers of the equipment which contains the embedded 
systems in question. Again, time is of the essence, so making contact with the right person in the suppliers’ 
organisation, and striking up a good working relationship with him or her is important. 


All of the above steps should lead towards testing of the systems to satisfy the business (landlord or tenant) 
that the systems will perform correctly on the day. Although each confidence building step is separate, some 
investigations can be undertaken in parallel. 


The Y2K embedded systems problem in property is very real and needs to be addressed by all concerned. 
Without gauging the size of the problem for a particular business it will remain an unsettling unknown. The 
worst case scenario could be arriving at work to find the doors firmly locked, the alarms on, security lights 
flashing, the CCTV malfunctioning, the heating and air conditioning systems inoperative and the car park 
gates jammed. Business could be severely disrupted—this would not be the most auspicious start to the 
millennium. The landlord must view the tenant as a customer to whom he is providing a service. The tenant 
may rent elsewhere upon renewal, or lease break, if he feels the landlord is not adequately addressing his 
responsibilities. This in turn may detrimentally affect the lettability (or saleability) of the accommodation, as 
prospective occupiers may look upon “Y2K compliant” space more favourably. 


Despite the potential for some severe disruption to business, KPMG’s experience is that there are still a 
large number of businesses that have yet to adequately address the Y2K issue. A third of KPMG’s 
respondents to the Information Security Survey 1998 (which had over 1,000 responses to its questionnaire 
from organisations in the UK and Ireland, each with an annual turnover of more than £10m) had not tested 
or received assurances from suppliers, a third had no project plan in place for IT application evaluation and 
testing, this rising to just under a half for embedded systems. The problem is likely to be magnified in the 
property industry due to embedded systems being commonplace in most buildings refurbished or built since 
the 1970s. 


KPMG use tried and tested methodologies in the specific area of embedded systems in property, as an aid 
to the swift and successful implementation of a Y2K project. KPMG also specialise in providing Health 
Checks for organisations carrying out their own Y2K projects. These Health Checks give a snapshot of how 
the project is progressing and provide guidance on any areas of potential high risk to the organisation. 


APPENDIX 55 


Memorandum submitted by the Department for International Development (DFID) 


DFID has considered what role it could play in addressing the problem of the computer compliance in the 
year 2000 and whether it should offer to make good the equipment which DFID has supplied'’. 


THE PROBLEM IN POOR COUNTRIES 


2. DFID’s responsibility focuses on poor countries in accordance with its purpose to promote sustainable 
development and to eliminate extreme poverty. At present, the scale of the Year 2000 compliance problem 
in developing and transitional countries is not well understood. The World Bank contacted 128 of their 





12 DFID understands the year 2000 compliance problem to mean the practice of computer programme designers to store date in 
programmes as two digits (97) rather than four (1997) and, as a result when dealing with dates in the 21st century (“00 rather 
than 2000”), hardware and software may fail or behave in unpredictable ways. Mainframes and PCs provided as late as early 
1997 may be non-compliant, while equipment supplied up to the late 1980s may not have been sufficiently sophisticated to be 
affected. However, software packages may also be date dependent. The problem applies not only to computers but to 
“embedded systems” found in power stations, building management systems and process controls. 
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borrowing member countries. Of the 78 who have replied, only 12 countries claimed to be prepared and 15 
others claimed to be aware of the problem. 


3. There is a need to assess the scale of the problem. This will involve determining the area and nature of 
IT dependence and testing systems for the occurrence of dates and non-compliant date systems using already 
available software packages. As a rough indication of IT dependence a list of exports of computer equipment 
to developing countries for which data is available is given in the Annex. 


4. In addition, developing countries may be affected by failures of compliance in global systems such as 
telecommunications, transport and automated business systems. Developing country systems may also 
contribute to these problems. There is a risk for developing countries that organisations in Year 2000 
compliant countries may turn off links with non-compliant systems to prevent contamination. 


5. The solutions to the Year 2000 compliance problem may not always be very difficult, but they can be 
complex, time consuming and expensive. Making information available about the risks will be a major task 
in developing countries, as will organising the availability of software and expertise, MADERRE the 
implementation process, making appropriate choices and supplying new kit. 


DFID Po.icy 


6. DIFD’s approach forms part of the Government’s strategy to raise international awareness and 
promote international action. Opportunities to raise these issues arise from the UK Government’s roles in 
the preparation for the Birmingham Summit and in the European Union. 


7. DFID has concluded that the World Bank is best placed to take the lead in addressing the problem in 
poor countries and that it should support their efforts without regard to the national origin of equipment or 
software. 


8. Developing countries are likely to have compliance problems with equipment and software which have 
been supplied from their own resources and by multilateral and bilateral donors including through aid- 
funding from the UK. These problems are likely to arise in applications, large and small, important and of 
lesser priority. 


9. To address all these problems will be beyond the means of developing countries. They will be faced with 
choices about how best to use limited resources, both their own and those provided by aid agencies. The 
choice will be between addressing the Year 2000 compliance problem and financing other services of 
government. Obviously developing countries should give priority to addressing those applications where 
failing to remove the Year 2000 compliance problem will have the most serious consequences. 


10. Asa bilateral donor, DFID is faced with similar choices in terms of what is most important. Rectifying 
problems on all equipment which DFID has supplied would not always have priority as between IT 
applications or between this problem and other requirements for poverty elimination. 


11. DFID is also at a disadvantage as compared with international financial institutions in terms of 
mobilising the resources to address the problem. One estimate of the global cost is 500 billion ECU. Even if 
the cost to developing countries is only a fraction of this, it is evident that only the international financial 
institutions and the private sector can provide the resources. 


WORLD BANK PROGRAMME 


12. The World Bank is actively promoting the need for millennium compliance and organising guidance 
for its client countries. Bank Country Directors have been charged with approaching senior country officials 
to raise awareness of the issue. Countires are being urged to designate Executive Sponsors and to identify a 
specific agency and staff to be responsible for carrying forward their own work and for relating to 
international donors. The Bank has also instructed staff to investigate compliance on current projects and to 
ensure requirements on compliance are included in future contracts. 


13. The Bank’s aim is to put the tools into the hands of developing country governments to enable them 
to identify the problem, to prioritise systems, and to protect those systems which are key to the economy and 
public order and well-being. It has initiated a project to develop a toolkit for review and prioritisation 
systems. They also propose to catalogue all the types of assistance available from IT companies. They plan to 
roll out a series of seminars through developing countries to raise awareness of the issues and these facilities. 


DFID AcTION 


14. DFID has been considering how best to support the Bank’s efforts. In the past DFID has found that 
it can have a catalytic effect by financing technical co-operation. By providing such funding through the 
World Bank it can energise both Bank operations and developing countries. The Government has therefore 
committed £10 million of grant aid to the World Bank Trust Fund for Information Development 
(INFODEV). These funds are earmarked for assisting poor countries to identify problems of Year 2000 
computer compliance, to design strategies to overcome the problem in priority areas, and to provide technical 
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co-operation in support of solutions. The first product of our collaboration is DFID’s financing of the toolkit 
project referred to above at a cost of £250,000. 


15. DFID is also ready to consider requests for assistance direct from its developing country partners. 
These would be financed from country development programmes. 


16. DFID is also planning ahead against the possibility that expertise and hardware will not be available 
to address developing country problems when they want it. This is likely to be between mid 1998 and, at least, 
the end of 2000. A crisis management capability will be required at the turn of the millennium. Prices for 
experts are being driven up in the UK and in India (a major supplier of programmers). While there is no 
absolute shortage as yet, the supply problems will get worse. 


COMPLIANCE OF AID-FUNDED EQUIPMENT 


17. DFID is advised that equipment currently being supplied under UK aid through the Crown Agents is 
millennium compliant. However, some IT is procured locally in developing countries using aid resources or 
is supplied by consultants. DFID is reminding current suppliers it is dealing with that it must have systems 
in place which fully meet the terms of those agreement and contracts which continue into the Millennium. 
DFID is also considering the need for additional clauses in its technical co-operation and capital aid 
agreements with developing countries. 


18. The vast majority of computers, embedded systems and software sent abroad under the aid programme 
now belong to developing country as ownership was either transferred at the outset under capital aid or was 
- gifted at the completion of the project if financed under technical co-operation. Given this DFID can only 
encourage developing countries to address compliance issues on old equipment. Where DFID staff are aware 
of potential difficulties with DFID supplied kit, they will alert the users to the problem and possible solutions. 


Annex 


EXPORTS OF ADP EQUIPMENT FROM OECD AND NEWLY INDUSTRIALISED ASIA TO 
AFRICA, ASIA AND THE CARIBBEAN 








US$ 000s 
AFRICA 
South African Customs Union 495,973 
Egypt 114,689 
Algeria 68,427 
Morocco 64,634 
Kenya 48,542 
Tunisia 46,848 
Nigeria 21,484 
Cote d’Ivoire 18,117 
Angola 16,472 
Libya 13,665 
Senegal 12,827 
Mauritius 11,465 
Gabon 11,326 
Ghana 9,383 
Zimbabwe 9,149 
Zambia 9,065 
Mali 7,168 
Congo 7,071 
Tanzania 6,411 
Ethiopia 6,122 
Guinea 6,033 
Madagascar 6,032 
Burkina Faso 5,254 
Benin 4,266 
Zaire 4,055 
Uganda 3,950 
Togo 3,699 
Niger 3,104 
Sudan 2,710 
Mauritania 2,640 
Rwanda 2.037 


Sierra Leone 2,597 
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Mozambique 
Malawi 

Cape Verde 
Central African Republic 
Eritrea 

Chad 

Gambia 

Djibouti 

Guinea Bissau 
Liberia 

Equatorial Guinea 
Saint Helena 
Somalia 


Regional Total 
ASIA 


China 
India 

Viet Nam 
Pakistan 
Sri Lanka 
Bangladesh 
Nepal 
Cambodia 
Mongolia 
Maldives 
Laos 
Seychelles 
Afghanistan 
Bhutan 


Regional Total 
CENTRAL AMERICA 


Costa Rica 

Jamaica 

Trinidad and Tobago 
Netherlands Antilles 
Dominican Republic 
Cuba 

Barbados 

Bahamas 

Cayman Islands 
Antigua and Barbuda 
Saint Lucia 

Aruba 

Haiti 

Grenada 

Saint Kitts and Nevis 
Saint Vincent and the Grenada 
Dominica 

Anguilla 

Montserrat 


Regional Total 
Grand Total 


Source: UN Comtrade Database 


2,066 
1,935 
1,857 
1,681 
1,308 
R2o7 
904 
869 
684 
627 
417 
195 

5 


1,059,653 


424,950 
396,063 
79,037 
30,508 
14,358 
13,637 
10,943 
4,877 
3,643 
1,651 
1,438 
913 

400 

79 


982,497 


28,668 
18,650 
16,347 
14,840 
11,877 
10,205 
9,273 
7,715 
3,939 
2,648 
2,421 
2,341 
Zyel ke 
913 
659 
583 
574 
111 
104 


134,140 
' 2,176,290 


THE SCIENCE AND TECHNOLOGY COMMITTEE 237 





APPENDIX 56 
Supplementary Memorandum submitted by Taskforce 2000 
UPDATE TO MEMORANDUM DATED 12 NOVEMBER 1997 


MAIN PoInts 


1. With only 21 months to the end of the century, a satisfactory outcome to the computer date change 
problem is impossible. Damage is therefore inevitable. The extent depends on how this emergency is handled 
from today onwards. 


2. Taskforce 2000 believes that successful damage limitation depends, in particular, on two factors: 
openness and personal accountability. 


3. The Government must provide high level leadership and should demonstrate the importance of the issue 
by its own actions with regard to Government compliance. The latter, in particular, is unsatisfactory at 
present. 


UPDATE 


1. Current surveys and Taskforce 2000 contact with business confirm: 
(a) fixing the date-change problem is proving to be an extraordinary challenge; 


(b) businesses that are getting on with it are, almost without exception, finding it to be more difficult 
than they expected; 


(c) budgets are escalating rapidly; 


(d) many large companies are a long way behind where they should be by now and are struggling, for 
example, with unexpected supply chain and embedded software problems and with the massive 
difficulties of testing their systems; 


(e) preparation for the introduction of the single currency is exacerbating difficulties; 
(f) there are real concerns about the preparedness of the utilities and telecommunications industries; and 
(g) the public sector is way behind the private sector leaders. 


Big computer jobs are usually late. This one—the biggest ever—is made worse by two factors: rapidly 
reducing time and too few skilled people. 


ACTION PLAN 


Taskforce 2000 has clear proposals to deal with the emergency. Key features of those proposals are: 


1. The Government should unambiguously confirm that we are now dealing with an emergency—advising 
people of the possible consequences and encouraging wide co-operation to avoid an unacceptable outcome. 
The creation of a situation of “informed anxiety” is essential. 


2. Ministers should publish lists of the critical systems in their departments affected by the problem— 
stating levels of confidence of achieving compliance, budget details, the names of the people responsible for 
compliance and details of the contingency plans being put in place where there are any fears of failure. This 
should be independently evaluated and reported on by the National Audit Office. 


3. The chief executives of all major utilities should be requested by Government to provide a public 
assurance that there will be no service interruption as a result of the date-change—the executives having 
responsibility for ensuring this should be named. If there is any uncertainty about the outcome it should be 
stated together with full details of any contingency plans. Where appropriate, regulators should be asked to 
conform publicly that they are satisfied with the responses provided. 


4. The Stock Exchange should require all listed companies to provide full details of compliance budgets 
and plans—including those relating to dependencies. An outline of any contingency planning should be 
included together with the names of the executives responsible. 


5. All the above information should be available by the end of June. 


6. The Bank of England and the Financial Services Authority should extend their current activities in this 
area to ensure that any potential failures in the financial sector are contained. Taskforce 2000 believes that 
this can be best accomplished by their providing regular reports not only on actions being taken, as presently 
planned, but also by publicly evaluating those actions (including contingency planning). Both bodies should 
state now what action they would take if any financial institution seemed unlikely to complete remedial action 
in time. 

7. Details of national contingency plans should be made publicly available by August this year. This is so 
that business people and others can relate them to their own planning. 
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8. The Prime Minister should call an urgent meeting of the CEOs of the largest IT businesses in the UK. 
The objective would be to determine what special measures can be taken to make more resource available to 
help minimise the problem. 


9. The British Government should, with the US Government, call an urgent international conference to 
encourage action throughout the global economy and recommend the emergency measures that are necessary 
to minimise international disruption. A particular area of concern must be international telecommunications. 


10. Taskforce 2000 has been saying for months that the single most effective contribution to a reduction 
in potential damage would be for the European Union to postpone the introduction of the single currency. 
That recommendation has been ignored and, in any case, Europe’s rush towards EMU seems almost 
unstoppable. But, to get the debate into the open, the Government should call for the European Commission 
to publish a report now on how, given the extreme shortage of skills and resources to do either job, it believes 
both can be accomplished in time. 


Taskforce 2000 is ready and waiting to co-operate with Government and others in considering these 
proposals in more detail and in putting them into effect. The nature of this emergency is such that all interested 
and knowledgeable parties must work together to tackle this unprecedented challenge. 


26 March 1998 


APPENDIX 57 


Memorandum submitted by the Association of Chief Police Officers 


I write as Second Vice-President of the Association of Chief Police Officers (ACPO) and carry the ACPO 
brief on issues relating to the Millennium. In fact I will be President over the Millennium. 


The following is provided on behalf of ACPO and addresses the questions posed. No doubt you are aware 
that the Association of Chief Police Officers was established to promote the effectiveness, efficiency and 
professional interests of the Police Service in England, Wales and Northern Ireland; and advises Her 
Majesty’s Government on policing issues. Membership includes all police officers holding rank or 
appointment above that of Chief Superintendent. 


1. Who, within the Police Authority, is responsible for ensuring that IT and imbedded systems are millennium 
compliant? 


As an operational matter, ensuring IT systems and equipment within each Force are Year 2000 compliant 
is the responsibility of each individual Chief Constable. The Police Authority is responsible for making funds 
available, against a costed policing plan, to allow him or her to discharge that responsibility. 


2. Has additional funding been made available for compliance projects? If not, how are the projects being 
financed? 


No new resources have been provided to cover auditing of current systems for compliance or, where 
required, to correct or replace those systems identified through audits as non-compliant. Following guidance 
provided by the Police Information Technology Organisation (PITO), Forces are handling auditing of 
systems as a priority, diverting existing resources to that purpose. Any subsequent replacement or 
refurbishment of systems shown not to be millennium compliant is being handled as part of the normal IT 
replacement programme. It would be expected that police authorities will assign a high priority to funding 
such essential millennium work which may be at the expense of other important projects elsewhere. 


3. To what extent have police authorities made progress towards compliance? 


To gain an overall impression on the state of readiness of the Police Service in respect of the Year 2000 
problem, PITO wrote to all Chief Constables in England, Wales and Scotland in February 1998 for response 
by the end of March. The questions posed were: 


—  Whatis the current position in your Force in respect of auditing your existing systems for year 2000 
compliance? 


— What work is in hand and what needs to be done to rectify problems which have been identified 
through audits? 


To date 29 of the 52 Forces/have provided responses to those questions. Of those responding, the vast 
majority have completed or are close to completing audits of their computer hardware, software and 
equipment suspected of containing computer chips. A substantial portion of Forces are now resolving 
millennium problems identified by audits and have projects in place to manage that process. 
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4. Are there any particular barriers preventing satisfactory progress towards achieving compliance and, if so, 
how could they be removed? 


The priority for Forces it to ensure the essential IT systems and equipment which are used to deliver core 
policing services to the public continue to work normally beyond the millennium change over. It is clear that, 
for some important operational systems, replacement or upgrade is required. The provision of new resources 
to carry out the necessary programme of work would reduce the risk that Forces will fail to achieve 
compliance because of lack of funds. 


Whilst Forces have made considerable progress towards identifying the work needed to achieve 
compliance, most systems are provided by outside suppliers. Those suppliers have, in many cases, been either 
slow to provide necessary information or have been unwilling to support existing non-compliant systems, 
preferring to offer a completely new compliant solution at increased cost. 


To address such supplier difficulties, ACPO and PITO have: 


— Facilitated the formation of Force user groups to tackle individual suppliers in respect of identifying 
and rectifying problems; 


— Organised regular conferences for all year 2000 managers in Forces so that experiences can be 
shared; and 


— Established an electronic year 2000 bulletin board, accessible to all Forces, through which 
information on problems and solutions can be shared. 


Even if Forces have fully operational IT systems and equipment, the police do not operate in isolation. For 
example, the police may have difficulty calling on ambulances, hospitals, fire and rescue, volunteers, social 
services, utilities, vets, interpreters etc to assist if those bodies and organisations are facing problems with 
their own IT systems. A significant factor in police preparedness for year 2000 is the ability of other 
organisations, on which the police depend, to continue to function normally after the millennium change 
over. 


If the police are to maintain public order and safety then industry, local and central government need to 
ensure their own systems are year 2000 compliant. Failures of systems elsewhere might impose significant new 
demands on the police which could overwhelm our ability to respond. The police are again dependent on 
others ensuring their systems work and do not create a greatly increased demand for police assistance. On a 
local basis, Forces are approaching industry and Government bodies for information on their state of 
preparedness and the potential for increased demand on police resources. 


Forces have long experience of dealing with major incidents and have detailed contingency plans in place 
to respond to such occurrences. Failure of IT systems elsewhere may generate a number of concurrent 
incidents which cannot be accommodated using plans designed for one-off occurrences. ACPO are already 
taking the lead in identifying and co-ordinating such operational issues to ensure the Police Service is properly 
prepared for emergencies arising from the millennium. 


5. To what extent do you expect police authorities to have achieved compliance by the turn of the century? 


Forces are heavily dependent on IT systems for providing assistance to the public. Failure of key 
operational IT systems, for example those used to respond to calls from the public, would disable that 
response, compromising public safety and order. With such systems, the alternative of a return to manual 
processes may not be viable given the complexity of the task and the volume of calls received even in normal 
circumstances. The only option is to ensure that such systems are year 2000 compliant. All Forces are 
committed to achieving compliance before 2000. 


Forces also depend on IT systems for a range of administrative police tasks, for example the processing of 
persons from arrest to trial. The failure of such IT systems would have a significant effect on the speed and 
quality with which justice is administered as well as on the police resources needed to undertake such tasks. 
Again Forces are aiming to have these systems fully compliant. A small number of administrative systems 
remain which are not core to policing, for example those used to manage a Forces’ estate or for planned 
maintenance of vehicles. Their failure is unlikely to have an immediate effect on a Force’s ability to police its 
area effectively. 


The effects on other equipment used by the police also needs to be considered. If police officers cannot 
access buildings or cell complexes because of failure of electronic locks, or lifts are inoperable, maintaining 
anormal level of service is, at best, hampered. All Forces have assessed the position in respect of such systems 
and are committed to achieve compliance before 2000. 


Technology also finds a place in equipment used to enforce the law (eg speed cameras and breath test 
devices) or to manage traffic (eg traffic signals). All may be affected by the year 2000 issue. There is then the 
question of whether evidence which relies on such technology might be challenged in court. These evidential 
issues are being tackled by ACPO with a commitment to resolve them before the millennium changeover. 
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6. What do you think central Government should be doing to assist police authorities in this matter? 


The Ministerial Group on the millennium date, with responsibility to co-ordinate action across the public 
and private sector, is a necessary step to ensure that organisations, both public and private, are made aware 
of the millennium problem and take appropriate action to ensure their systems are year 2000 compliant. The 
position of others has a major impact on the police both in our ability to respond effectively and in terms of 
the demand for assistance which may arise. Such steps to co-ordinate action on year 2000 across Government 
and industry are welcome. 


Force expenditure is already severely constrained. The need to fund changes to IT and other systems to 
ensure millennium compliance further tightens the pressure on funding. Currently, the priority must be to 
complete essential millennium work but this is at the expense of other important albeit less critical areas of 
work. The provision of new money to cover the costs of millennium compliance would allow Forces to 
recover some of the ground lost by diverting resources to that task. 


I hope this submission is helpful for your purpose. Please feel free to use me as a conduit on behalf of ACPO 
and, in that regard, I will ensure my colleagues are kept informed of progress and developments. 


26 March 1998 


APPENDIX 58 
Memorandum submitted by the British Institute of Facilities Management 


1. The British Institute of Facilities Management (BIFM) is the national body representing individual 
professionals working in facilities management in the public and private sectors. Facilities Management is 
the fastest growing sector in British industry employing over 25,000 people in a £160 billion industry. 


2. The growth of Facilities Management in this country has been stimulated by the rapid and innovative 
advances in technology, the development of management practices and the changing environment at places 
of work. In addition, the growth of privatisation, contracting out and rationalisation has put even more 
emphasis on the need for efficient and effective practice whether in public or private sectors. The BIFM 
straddles both sectors. 


3. Facilities Management is the integration of multi-disciplinary activities in the built environment and the 
management of their impact on people and the workplace. Within this fast growing professional discipline, 
facilities mangers have extensive responsibilities for providing, maintaining and developing services ranging 
from property strategy, space management and communications infrastructure to building maintenance, 
administration and contract management. 


4. Facilities Managers are “the voice of the occupier” who’s role is not only to champion the welfare and 
safety of the workforce but also to have responsibility for co-ordinating a wide range of activities that support 
the work environment and working practices. It is the facilities managers’ responsibility to ensure that the 
workplace is a safe and healthy environment to work in and that the services provided for or by the 
organisation are effective and efficient. 


5. In order to do this, facilities managers rely on IT systems to work, be they Building Maintenance 
Systems, electronic (such as doors, lifts, car park barriers), or utilities (electricity, gas, oil and water supply) 
which are the base source for many of the operations upon which buildings, be they hospitals, schools or 
offices depend. 


6. The facilities manager will be expected to have co-ordinated the multiplicity and complexity of services 
in preparation for the millennium timebomb, and it is the facilities managers task to alert others to the need 
for a proper audit for Millennium compliance and ensure that appropriate action is taken. This, the BIFM 
is supporting through a number of seminars on Compliance across the UK and by regular reference in its 
publications. 


7. It is not only large industrial organisations who need to be aware and able to manage the impact of the 
Year 2000 syndrome but also all those other organisations within the facilities managers’ work—hospitals, 
schools, railway stations, hotels or office blocks where IT support systems rely on microchips (even the 
Houses of Parliament .. .). 


8. Unless utilities suppliers; landlords and property managing agents in particular, address the issues of 
compliance we can envisage security alarms ringing ad nauseum or even worse, failing to ring at all; heating 
systems failing to recognise its Winter or to switch off, significantly affecting working conditions and Health 
and Safety regulations; automated water supplies causing flooding in offices, factories etc, and finally, the 
workforce failing to report to work because the infrastructure systems of road and rail which depend upon 
electronic means, fail or the automatic security system in office and factory doors lock everybody out. 


9. The BIFM supports the recent initiatives taken so far by the Government, but is conscious that these 
initiatives may be too little and too late. It is vital, therefore, that senior decision makers within the public 
and private sectors recognise ayd understand the Year 2000 problem, and the potential impact it may have 
on the efficiency of their operations and the welfare of their employees. Monday, 3 January may be too late. 
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